Attributed metadata history

Up to 100 retained publisher events per page for 8cdf9b3514bfd47dc559098f837f7b55bbb45876251985c5e45c5806a19ae844. Withdrawals and unavailable references remain attributed to their publishers.

intelligence_src_d11443da85ea659d49

observed · 2026-10-12 15:37:04 UTC

A flaw in Amazon Managed Workflows for Apache Airflow (MWAA) could have allowed potential session hijacking and remote code execution. The issue stemmed from a combination of session fixation in the MWAA web management panel and an AWS domain configuration error leading to a cross-site scripting (XSS) attack. Attackers exploiting this could manipulate victims' configurations, trigger workflows, and potentially move laterally to other services within the cloud environment. The exploit of this bug involved deploying malicious code via an Amazon API Gateway that interacts with the victim’s Airflow instance, setting a session cookie that bypasses normal authentication and grants the attacker access.

Fingerprint: bdadf2bb1239795be36fb17c5c4cf2e785dae90048a81616c2f7f4a95af2b5ea

intelligence_src_d11443da85ea659d49

observed · 2026-10-12 15:37:03 UTC

available

Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c