Apache Airflow Authorization Bypass Vulnerability in DagRun Wait Endpoint XCom Exposure

A vulnerability in Apache Airflow versions 3.0.0 prior to 3.2.0 allows an authorization bypass in the DagRun wait endpoint, where XCom result values are exposed to users with only DAG Run read permissions, such as those in the Viewer role. This issue contradicts the FAB RBAC model, which considers XCom a separate protected resource, and the security model documentation that designates the Viewer role as read-only. The vulnerability arises because Airflow's access control, managed by the FAB Auth Manager, fails to properly restrict XCom access for users with limited permissions.

Impact

Exploitation of this vulnerability leads to unauthorized access to XCom result values, which may contain sensitive execution results, for users with DAG Run read permissions.

Remediation

Users are advised to upgrade to Apache Airflow 3.2.0, which addresses this vulnerability.