Information Disclosure in Apache Airflow

Executive Summary

This vulnerability in Apache Airflow occurs when multiple DAGs (Directed Acyclic Graphs) are defined in the same source file. Before version 3.3.0, if a user was authorized to read one DAG in that file, they could access the entire source file, including other DAGs they were not authorized to read.

Specifically, the API endpoint `/api/v2/dagSources/{dag_id}` and the equivalent UI view would return the full source code of the file containing multiple DAGs without redacting unauthorized DAGs. This bypassed the intended per-DAG read authorization controls.

The issue affects deployments that co-locate multiple DAGs in a single file and rely on per-DAG access control to limit source visibility. Deployments with one DAG per file are not affected.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the behavior of the `/api/v2/dagSources/{dag_id}` endpoint in Apache Airflow when accessing DAGs that are co-located in the same source file. Specifically, if a user authorized to read one DAG can retrieve the entire source file including other DAGs they are not authorized to read, the vulnerability is present.

A practical approach is to use HTTP requests to the vulnerable endpoint with different DAG IDs and observe if the response includes source code of unauthorized DAGs.

Example command using curl to test the endpoint:

• curl -i -H "Authorization: Bearer <token>" https://<airflow-host>/api/v2/dagSources/<dag_id>

Replace `<token>`, `<airflow-host>`, and `<dag_id>` accordingly. If the response contains source code of DAGs other than the requested one, the vulnerability exists.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation is to upgrade Apache Airflow to version 3.3.0 or later, where this vulnerability has been fixed.

Until the upgrade can be performed, consider avoiding co-locating multiple DAGs in the same source file if relying on per-DAG access control to limit source visibility.

Additionally, review and restrict user permissions to minimize exposure and monitor access logs for suspicious requests to the `/api/v2/dagSources/{dag_id}` endpoint.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a user authorized to read one DAG to access the source code of other DAGs co-located in the same source file without proper authorization. Such unauthorized disclosure of source code could lead to exposure of sensitive information or intellectual property.

In environments subject to compliance standards like GDPR or HIPAA, unauthorized access to sensitive data or code could violate data protection and confidentiality requirements. Specifically, if DAG source code contains sensitive logic, credentials, or personal data processing details, this vulnerability could lead to non-compliance by failing to enforce strict access controls.

Therefore, deployments that rely on per-DAG access control but co-locate multiple DAGs in a single file may be at risk of violating compliance standards due to this improper authorization bypass.

Upgrading to Apache Airflow 3.3.0 or later, which fixes this issue by enforcing per-file authorization, is necessary to maintain compliance with such standards.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive source code for DAGs that a user is not permitted to access.

If your deployment places multiple DAGs in the same source file and relies on per-DAG access control, an authorized user for one DAG could view the source code of other DAGs in that file, potentially exposing confidential logic, credentials, or business processes.

This could result in information leakage, increased risk of insider threats, or exposure of proprietary workflows.

Useful 0 Not Useful 0