Apache Airflow Asset Graph View Bypasses DAG Read Permissions

A vulnerability in Apache Airflow's asset dependency graph view prior to version 3.2.1 allows users with read access to at least one Directed Acyclic Graph (DAG) to view the asset graph for any other asset in the deployment. This oversight enables them to discover the existence and names of DAGs and assets beyond their authorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized visibility of DAGs and assets, allowing users to access information outside their permission scope.

Remediation

Users are advised to upgrade to Apache Airflow version 3.2.1 or later, which addresses this vulnerability.