Executive brief
Apache Airflow is a workflow orchestration platform that uses Python to define data pipelines. The /api/v2/dagReports API endpoint allows authenticated users to execute arbitrary Python code from DAG files on the API server, potentially leading to unauthorized code execution and data theft if the API server has access to DAG files. This could enable attackers to compromise the API server infrastructure and access sensitive data or workflows.
Technical details
The vulnerability exists in the /api/v2/dagReports API endpoint (Airflow 3.0.0 through 3.1.0), which fails to properly restrict Python code execution when processing DAG definitions. The root cause is improper privilege separation—the endpoint executes DAG Python code in the context of the API server without proper sandboxing. An authenticated API user (authenticated via authentication) can trigger arbitrary code execution by sending requests to this endpoint, provided the API server is deployed in an environment where DAG files are available. The attacker gains the ability to execute Python code with the privileges of the API server process. The endpoint was removed entirely in version 3.1.1 as the fix (commit 828aaa0b1d95caf90612a648867c17aec7e87874).
Affected products
- Apache Airflow 3.0.0 through 3.1.0
Timeline
- 2025-10-30: disclosed: Advisory published
- 2025-10-14: patched: dagReports API endpoint removed in fix commit
- 3.1.1: other: Vulnerability fixed in version 3.1.1