Apache Airflow Wildcard DagVersion Listing Bypasses Per-DAG Authorization

A vulnerability in Apache Airflow in versions 3.0.0 through 3.1.7 allows unauthorized access to DAG version metadata. The issue arises in the FastAPI DagVersion listing API, which fails to enforce per-DAG authorization filtering when the dag_id is set to the wildcard character '~', representing all DAGs. Consequently, version information for DAGs that the requester is not permitted to access is inadvertently disclosed.

Impact

Exploitation of this vulnerability leads to unauthorized access to DAG version metadata, potentially exposing sensitive information about workflows that the user should not have access to.

Remediation

Users are advised to upgrade to Apache Airflow version 3.1.8 or later, which addresses this vulnerability.