This vulnerability in Apache Airflow 3.0.0 involves the login redirect route where authenticated users can craft URLs that circumvent the is_safe_url validation. This flaw enables redirection from a trusted Airflow domain to an untrusted, attacker-controlled origin, classified as CWE-601 (URL Redirection to Untrusted Site). The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change. The vendor recommends upgrading to version 3.2.2 or later. Additionally, deployment operators can mitigate risk by placing Airflow behind a reverse proxy that removes off-domain next= parameters before login processing.

Successful exploitation allows authenticated users to redirect legitimate Airflow users to attacker-controlled sites, potentially facilitating phishing or other malicious activities that compromise confidentiality and integrity of user sessions. There is no direct impact on availability. The vulnerability affects confidentiality and integrity with a scope change, as indicated by the CVSS vector.

Users should upgrade Apache Airflow to version 3.2.2 or later, where this vulnerability is fixed. As a defense-in-depth measure, deployment operators can configure a reverse proxy in front of Airflow to strip off-domain next= query parameters before they reach the login endpoint. Patch status is not explicitly confirmed in the provided data, but the vendor advisory recommends upgrading to 3.2.2 or later, indicating an official fix is available.