Jarek Potiuk

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-fab versions prior to 3.7.2 **Description** In the Apache Airflow FAB auth manager, a privilege escalation occurs when a DAG is created with a `dag id` of `DAGs`. This specific ID collides with the global all-DAGs permission resource name generated by the `resource name()` function. Consequently, a lower-privileged user granted per-DAG `access control` for that specific DAG is silently granted global permissions, allowing them read and edit access to every DAG in the system. **Recommendations** Upgrade to apache-airflow-providers-fab 3.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.3.0 **Description** The REST API task-instance detail and list endpoints return a deferred task's trigger kwargs without masking. This allows any authenticated user with DAG-scoped task-instance read access to view sensitive information, such as provider API keys, in clear text while the task is deferred. **Recommendations** Upgrade to version 3.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow versions prior to 3.3.0 **Description** An authorization bypass occurs when a user with permission to read a specific Dag can disclose the source code of other Dags located within the same source file. This issue affects deployments that co-locate multiple Dags in a single file and rely on per-DAG access control. The flaw exists in the `GET /api/v2/dagSources/{dag id}` endpoint and the corresponding Dag-source view in the UI, which return the entire source file without redacting unauthorized Dags. The `dag id` variable is used to identify the requested Dag. **Recommendations** Upgrade to apache-airflow version 3.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.3.0 **Description** The Config API exposes per-key secrets-backend overrides, such as environment variables `AIRFLOW SECRETS BACKEND KWARG SECRET ID` and `AIRFLOW WORKERS SECRETS BACKEND KWARG SECRET ID`, as synthetic config options. Because these option names are not included in `sensitive config values`, the masker fails to redact them. Consequently, an authenticated UI or API user with Config read permission can retrieve plaintext secrets-backend credentials, including Vault `role id` and `secret id`, from the Config API output. **Recommendations** Upgrade to apache-airflow version 3.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.3.0 **Description** A bug in the `/ui/dependencies` scheduling graph endpoint allows an authenticated UI user with read permissions on some Dags to enumerate identifiers of other Dags they are not authorized to read. While the system applies a readable-Dag filter to the top-level serialized Dag key, it fails to propagate this filter to the `dep.source` and `dep.target` fields of trigger and sensor dependency entries. This issue affects deployments that use per-Dag read scoping to maintain privacy of Dag identifiers across teams. **Recommendations** Update to version 3.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow versions prior to 3.3.0 **Description** A bug in the `BaseSerialization.deserialize()` function allows unrestricted `import string()` of attacker-controlled class paths when the Scheduler or API Server loads a serialized DAG. A DAG author can embed a malicious trigger into a DAG to achieve remote code execution on the API Server or Scheduler process, bypassing the security boundary that prevents DAG-author code from executing within those processes. **Recommendations** Upgrade to apache-airflow version 3.3.0 or later. Restrict the `[core] allowed deserialization classes` configuration to a narrow allowlist in deployments where trust in DAG authors is limited.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-google versions prior to 22.2.1 **Description** The `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` operators in the Google provider join GCS object names from the bucket listing API to a destination filesystem path without normalization or containment checks. An attacker with write access to the source GCS bucket can create objects containing `..` segments, leading to a path traversal. This allows the DAG run to write downloaded blobs outside the intended destination, specifically the `destination path` for `GCSToSFTPOperator` or the worker-local temp directory for `GCSTimeSpanFileTransformOperator`, potentially overwriting arbitrary files on the SFTP server or the worker host. **Recommendations** Upgrade to apache-airflow-providers-google 22.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-sftp versions prior to 5.8.1 **Description** A path traversal issue exists in the SFTP provider. A malicious or compromised remote SFTP server can write files outside the configured local destination directory by using crafted directory-entry names. This can be triggered through the `SFTPHook.retrieve directory()` function or the `SFTPOperator(operation=get)` operator. No account is required for this to occur; the risk applies to any deployment that downloads directories from an untrusted SFTP server. **Recommendations** Upgrade to version 5.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-samba versions prior to 4.12.6 **Description** The `GCSToSambaOperator` in the Apache Airflow Samba provider fails to perform a containment check when joining GCS object names to the SMB destination path. This allows an attacker who can write objects into the source GCS bucket to use `../` segments in object names to resolve a write path outside the configured `destination path`, enabling the writing of files to arbitrary locations on the Samba target. **Recommendations** Upgrade apache-airflow-providers-samba to version 4.12.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The EmailOperator and `airflow.utils.email` helpers establish SMTP STARTTLS connections without verifying the remote certificate when the deployment is configured with `smtp starttls=True` and `smtp ssl=False`. This allows an attacker positioned between the worker and the SMTP server to perform a Man-in-the-Middle (MITM) attack by presenting a self-signed certificate. Consequently, the attacker can silently complete the STARTTLS handshake and capture SMTP AUTH credentials and the contents of forwarded messages. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize reference`) imports and dispatches arbitrary class paths from serialized state controlled by a DAG author without using an allowlist or plugin-registry gate. In deployments where DAG-author code is less trusted than the scheduler process, such as single-host deployments where the DAG bundle is importable from the scheduler process, an attacker could embed a custom `DeadlineReference`. This allows the attacker to specify a controlled module path, leading the scheduler to execute `import string(...)` and instantiate the class with an active SQLAlchemy session attached. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The Log server authorizes JWT tokens against Dag IDs by applying the `str.lstrip()` function to the requested path segment when verifying the `sub` claim. Because `str.lstrip()` removes any character from a specified set rather than a specific prefix, a token issued for one Dag can authorize access to any other Dag whose name begins with any subset of the characters in the original Dag's name. This allows an authenticated Airflow worker with a valid Log-server JWT to enumerate and read logs of other Dags, potentially leaking task output and error traces. This issue affects deployments using per-Dag log-access scoping, such as multi-team, shared-executor, or shared-worker topologies. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the GET '/api/v2/connections/{connection id}' REST API endpoint allows an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob. This occurs when secrets are stored under field names not included in the redaction allowlist (`DEFAULT SENSITIVE FIELDS`), resulting in sensitive data, such as Slack-provider credential field names, being returned in plaintext. This issue affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. **Recommendations** Upgrade to version 3.2.2 or later. Store sensitive credential values in a secret-backend instead of inlining them into the Connection's `extra` field.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A flaw in the `FileTaskHandler` allows a DAG author to access or modify files outside the configured `base log folder` when the worker log folder is shared with the API server. This can be achieved through a read-path attack by creating a symlink in the task's log directory pointing to an arbitrary file readable by the API server process, such as `/etc/passwd` or `airflow.cfg`. Alternatively, a write-path attack can be performed by providing a `task id` containing `..` sequences that are accepted by the Task SDK's `KEY REGEX`. These actions can lead to the leakage or overwriting of arbitrary files. **Recommendations** Upgrade to version 3.2.2 or later. Deploy the worker and API server with separate log volumes to ensure worker-controlled paths cannot reach the API server's filesystem.

**Name of the Vulnerable Software and Affected Versions** apache-airflow versions prior to 3.2.2 **Description** The 'structure data' endpoint in the Airflow UI fails to verify if the caller has read permissions for linked DAGs (Directed Acyclic Graphs, which are collections of all the tasks you want to run, organized in a way that reflects their relationships and dependencies). Consequently, an authenticated UI or API user with authorization for one DAG can enumerate linked DAG IDs and dependency metadata for other DAGs they are not authorized to access. This issue impacts deployments using per-DAG read scoping to maintain the privacy of DAG dependency topology across different teams. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The `JWTRefreshMiddleware` sets the JWT authentication cookie without the `Secure` flag. In deployments where the Airflow API server is positioned behind an HTTPS-terminating reverse proxy, the session JWT can be replayed over cleartext HTTP requests to the same host. A network-positioned attacker could induce a logged-in user's browser to issue an HTTP request to the hostname, capture the JWT cookie, and replay it against the authenticated API. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the Variable response masker allows the bypass of nested-key redaction when the nesting depth of a JSON value exceeds the recursion limit of the shared secrets masker. This occurs with key names suffixed by secrets, such as `password`, `token`, `secret`, or `api key`, as the masker returns the original nested item before verifying the sensitive key name. An authenticated UI or API user with Variable read permissions can harvest plaintext secret values stored within deeply-nested JSON Variables. **Recommendations** Update to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the XCom PATCH endpoint "PATCH /api/v2/xcomEntries/{key}" allows an authenticated UI/API user with XCom write permission on a Dag to set XCom entries using reserved key names, such as `return value`. While the POST endpoint validates against `FORBIDDEN XCOM KEYS`, the PATCH endpoint does not. Additionally, the endpoint accepts serialized payload shapes that the triggerer's deserializer treats as code. This combination enables Remote Code Execution (RCE) on the triggerer when the affected task next defers. This issue specifically affects deployments where untrusted users possess XCom write permissions on Dags that defer to the triggerer. **Recommendations** Update to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the rendered-template field handling allows the bypass of nested sensitive-key masking. When a rendered field exceeds the `[core] max templated field length` limit, the software stringifies the structure before redaction, which removes the nested key context and results in plaintext values being persisted into `rendered fields`. This affects deployments where DAG authors pass structured JSON to operators containing nested sensitive keys such as `password`, `token`, `secret`, or `api key`. An authenticated UI or API user with permissions to read rendered template fields can harvest these secret values. **Recommendations** Update to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow versions prior to 3.2.2 **Description** The 'partitioned dag runs' endpoints in the UI enforce only asset-level access control instead of per-Dag authorization. This allows an authenticated UI or API user with global `Asset:read` permission to enumerate the partition run state, schedule configuration, and asset wiring for Dags they are not authorized to read. This issue impacts deployments that use per-Dag read scoping while granting users broader Asset access. **Recommendations** Upgrade to version 3.2.2 or later.