Apache Airflow Authorization Vulnerability in Execution API Human-in-the-Loop Endpoints

An authorization vulnerability has been identified in Apache Airflow versions 3.1.0 through 3.1.7. This vulnerability exists in the Execution API's Human-in-the-Loop (HITL) endpoints, where any authenticated task instance can read, approve, or reject HITL workflows of other task instances. The issue arises from insufficient authorization checks, allowing unauthorized access to HITL workflow management.

Impact

Exploitation of this vulnerability allows for unauthorized manipulation of HITL workflows, including reading, approving, or rejecting workflows belonging to other task instances.

Remediation

Users are advised to upgrade to Apache Airflow version 3.1.8 or later, which addresses this vulnerability.