Apache Airflow 3.3.2 Fixes Authorization and Token Handling
Tech GuruQuick Answer
Apache Airflow 3.3.2 fixes three separate issues: asset-event disclosure across DAG permissions, cookie/bearer identity confusion, and failure to revoke bearer tokens at logout. The identity-precedence flaw affects only 3.3.0 and 3.3.1; the other issues have different ranges and prerequisites described below. Upgrade through the supported deployment process and validate all applicable authorization paths.
Confirm Scope And Apply The Supported Fix
What to do now: Record Airflow versions, per-DAG permissions, shared-domain exposure, and API authentication methods. Upgrade to 3.3.2 or later, then verify event visibility/counts, explicit-credential precedence, and bearer-token revocation with authorized test accounts.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Apache Airflow releases before 3.3.2, subject to the advisory-specific starting versions |
|---|---|
| Advisory | CVE-2026-75158 / CVE-2026-82355 / CVE-2026-86473 |
| CVEs | CVE-2026-75158, CVE-2026-82355, CVE-2026-86473 |
| Earliest listed CVE record publication | 2026-09-21 14:32:04.932 UTC |
| Recorded source revision (historical snapshot) | 2026-09-21 15:26:48.122 UTC |
| Affected versions | Apache Airflow releases before 3.3.2, subject to the advisory-specific starting versions |
| Fixed version | Apache Airflow 3.3.2 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Asset Events Cross DAG Boundaries
CVE-2026-75158 affects the /assets/events API before 3.3.2. An authenticated user with asset-read access can obtain events from DAGs they cannot otherwise read, exposing source DAG, task and run identifiers and timestamps. The missing authorization filter also affects counts and pagination, so hiding event rows alone does not prevent disclosure of another DAG's existence. This matters wherever per-DAG permissions separate teams or tenants; no additional configuration is required.
Cookie Overrides Explicit Credentials
CVE-2026-82355 affects only 3.3.0 and 3.3.1; earlier releases lack the vulnerable caching path. If a request contains both a session cookie and an explicit bearer credential, the cookie's identity wins. Actions and audit records can therefore use the wrong principal. This is identity confusion, not direct privilege escalation.
The attacker must first place a valid session cookie of their own in the victim's client. Apache lists sibling-subdomain cookie tossing, XSS in another application sharing a parent domain, and shared workstations as examples. A dedicated domain without co-hosted applications avoids the shared-domain route described by Apache; it is not a reason to disregard the separate client-cookie prerequisite. Version 3.3.2 restores priority to explicit credentials.
Bearer Logout Does Not Revoke The Token
CVE-2026-86473 affects 3.0.0 through releases before 3.3.2. The logout endpoint revokes a session presented in the _token cookie, but not one presented in an Authorization: Bearer header, despite returning its normal response. API clients using bearer authentication are affected. A copied token can remain usable until expiry, which defaults to 24 hours but is configurable.
The attacker must already possess a valid token; obtaining it is outside this vulnerability, and it grants no permissions beyond the victim's. Updating to 3.3.2 or later addresses all three issues. Preserve audit and session evidence: a successful update does not itself establish that previously exposed events or tokens were unused.
What To Validate Now
- Inventory. Record deployed core API versions, DAG authorization boundaries, asset-read roles, UI domain sharing, bearer-token clients, and configured token lifetime.
- Establish applicability. Assess asset events before 3.3.2; cookie precedence in 3.3.0/3.3.1 only; and bearer logout from 3.0.0 to before 3.3.2. Apply each issue's access and credential prerequisites separately.
- Remediate. Apply Apache Airflow 3.3.2 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. In an authorized test environment, check that both event rows and counts respect DAG permissions, mixed-credential requests use the explicit identity in actions and audits, and a logged-out bearer token is rejected. Record actual results; these checks have not been performed by this review.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve authorization configuration and relevant audit/session evidence before changing the deployment. Cookie precedence requires prior placement of an attacker's valid cookie; logout persistence requires an already-copied token. Neither issue creates new privileges by itself, and a normal logout response is not evidence of revocation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
