In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation.
database
{ "cpes": [ "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*" ], "severity": "Critical" }