AWS Patches Critical 'FlowFixation' Bug in Airflow Service to Prevent Session Hijacking

Researchers disclosed FlowFixation, a now-patched vulnerability in AWS Managed Workflows for Apache Airflow (MWAA) that combines session fixation and a domain misconfiguration enabling XSS-based session hijacking. An attacker who took over a victim's session could read connection strings, modify configurations, trigger DAGs, potentially achieve remote code execution on underlying instances, and move laterally; AWS and Azure mitigated the issue by updating the Public Suffix List while Google Cloud deemed the issue lower priority.