This vulnerability involves a flaw in the login redirect route of Apache Airflow 3.0.0 where the is_safe_url validation can be bypassed by authenticated users. This enables an open redirect attack (CWE-601), allowing redirection from a trusted Airflow domain to an untrusted, attacker-controlled origin. The issue is fixed in Apache Airflow 3.2.2 and later versions. Deployment operators are recommended to implement reverse proxy rules to remove off-domain next= parameters as an additional mitigation.

The vulnerability allows authenticated users to craft URLs that redirect users from the trusted Airflow domain to attacker-controlled sites. This can facilitate phishing or other social engineering attacks by leveraging the trusted domain. There is no indication of known exploits in the wild. The impact is limited to authenticated users and relies on redirecting users to malicious sites.

Users should upgrade to Apache Airflow version 3.2.2 or later, where this vulnerability is fixed. As a defense-in-depth measure, deployment operators can configure a reverse proxy to strip off-domain next= query parameters before they reach the login endpoint. Patch status is not explicitly confirmed in the vendor advisory, but the upgrade recommendation indicates an official fix is available in 3.2.2+. No other mitigation or no-action statements are provided.