AIKIDO-2026-413403

TL;DR

The Airflow core API uses the session cookie for the request identity whenever a cached cookie user injected by middleware is present, even when the request also has an explicit Authorization: Bearer token or OAuth2 token. The bearer or OAuth2 credential is ignored, so the request runs and the audit log records the cookie principal instead of the identity the client presented. Exploiting this needs a session cookie belonging to someone else already present in the caller's browser or client, for example through cookie tossing from a sibling subdomain or a shared workstation. The fix checks explicit bearer and OAuth2 credentials first and only falls back to the cookie when no explicit credential is present.