CyberRota Analysis
AI-GeneratedApache Airflow versions prior to 3.3.0 are vulnerable to an authorization bypass that allows users with read access to one Directed Acyclic Graph (DAG) to view the source code of other DAGs within the same source file. This could lead to unauthorized disclosure of sensitive information, particularly in deployments that co-locate multiple DAGs in a single file. Organizations using affected versions should prioritize upgrading to 3.3.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later.
Related CVEs
Other vulnerabilities affecting the same vendor(s)