Apache Airflow Per-DAG Access Control Vulnerability in Dags Endpoint

A vulnerability exists in the Apache Airflow '/ui/dags' endpoint prior to version 3.2.1, where per-DAG access control is not properly enforced on embedded Human-in-the-Loop (HITL) and TaskInstance records. This flaw allows authenticated users with read access to at least one DAG to access HITL prompts, including request parameters, and full TaskInstance details for DAGs outside their authorized scope. The exposed HITL prompts and TaskInstance fields often contain operator parameters and free-form context related to tasks, thereby breaching the intended per-DAG role-based access control (RBAC) for all authenticated users.

Impact

Exploitation of this vulnerability allows for unauthorized access to HITL prompts and TaskInstance details from DAGs outside the user's authorized scope, violating per-DAG RBAC boundaries.

Remediation

Users are advised to upgrade to Apache Airflow version 3.2.1 or later, which addresses this vulnerability.