Executive brief
Apache Airflow is an open-source workflow orchestration platform used to schedule and monitor data pipelines. A vulnerability allows authorized users with restricted access to specific workflows (DAGs) to read detailed information about task executions in other workflows they should not have access to. This can expose sensitive operational data, job parameters, and execution logs across the entire organization.
Technical details
The vulnerability is an access control flaw (CWE-200) in the Apache Airflow REST API batch task instance endpoint. An authenticated user with permissions to view only specific DAGs can bypass authorization checks to retrieve task instance metadata from DAGs they are not authorized to access. The vulnerability exists in versions before 2.7.2, with no special preconditions beyond having valid API authentication. The attack vector is network-based and requires an authenticated user. The fix was implemented in PR #34315, adding proper authorization checks to the batch endpoint, and patch 2.7.2 and later are available.
Affected products
- Apache Airflow before 2.7.2
Timeline
- 2023-10-14: disclosed: GHSA-32wr-qqw6-5mfp published
- 2023-10: patched: Fix merged in PR #34315 and released in version 2.7.2