Apache Airflow DAG Parsing Error Kwargs Disclosure Vulnerability

A vulnerability exists in Apache Airflow versions prior to 3.1.4, where the error-reporting UI could inadvertently expose full keyword arguments (kwargs) passed to operators in the event of a Directed Acyclic Graph (DAG) parsing failure. If these kwargs included sensitive information, such as secrets, this data could be visible in the UI tracebacks to authenticated users with permission to view the DAG.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, such as secrets, to authenticated users via the Airflow UI.

Remediation

Users are advised to upgrade to Apache Airflow versions 3.1.4 or 2.11.1.