CVE-2022-45402: Apache Airflow webserver login endpoint open redirect

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw is a medium-severity open redirect requiring user interaction, but the high EPSS score and exposed webserver make it worth prompt patching.

What it is

Apache Airflow versions prior to 2.4.3 contain an open redirect in the webserver's /login endpoint. The flaw lets a crafted link send a user to an attacker-controlled site after login, which matters for phishing and credential theft against Airflow operators. The record does not list affected version ranges beyond 'prior to 2.4.3' or any vendor-specific deployment caveats.

Impact

An attacker can redirect a victim from the trusted Airflow login page to an arbitrary external site, enabling phishing or credential harvesting under the guise of the Airflow host. The CVSS vector shows limited confidentiality and integrity impact with no availability impact.

Attack surface

Reachable over the network via the webserver's /login endpoint with no authentication required, but exploitation requires user interaction because the victim must follow a crafted link. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at 0.81836 (percentile 0.99629), and references include patch and vendor advisory tags but no public exploit tag.

What to do

• Upgrade Apache Airflow to 2.4.3 or later, which contains the fix referenced in the patch PR.
• Restrict network access to the Airflow webserver so it is not exposed to untrusted networks.
• Validate or whitelist redirect targets on the /login endpoint if you cannot patch immediately.
• Warn users not to follow unexpected Airflow login links and to verify the destination host before authenticating.

Detection

• Review webserver access logs for requests to /login with redirect or next parameters pointing to external domains.
• Alert on outbound redirects from the Airflow host to unfamiliar or non-corporate domains.
• Monitor for phishing reports or user reports of Airflow login links that resolve to external sites.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.