Executive brief
Apache Airflow is a widely-used workflow orchestration platform that manages data pipelines. This vulnerability allows authenticated users to bypass authorization checks and read directed acyclic graphs (DAGs) they should not have permission to access by manipulating URL parameters. An attacker with valid credentials could gain unauthorized visibility into sensitive workflow configurations and data.
Technical details
This is an authorization bypass vulnerability (CWE-863) affecting Apache Airflow versions before 2.6.3. The root cause is that the application only validated the DAG ID in request args and form parameters, but failed to check it when passed via URL query parameters (kwargs). An authenticated attacker can craft a request that passes the DAG ID through kwargs instead, causing the authorization check to receive a None value and bypass the permission validation. The fix, merged in PR #32014, ensures the DAG ID is validated regardless of the parameter source. Network access and valid credentials are required; no special user interaction is needed.
Affected products
- Apache Airflow before 2.6.3 (1.x and 2.0–2.6.2)
Timeline
- 2023-07-12: disclosed
- 2023-07-12: patched: Fix released in version 2.6.3