The vulnerability in Apache Airflow 3.2.0 involves insufficient authorization checks on the partitioned_dag_runs endpoints in the Airflow UI and API. Specifically, these endpoints enforce only asset-level access control rather than per-DAG authorization, enabling authenticated users with global Asset:read permission to enumerate partition run states, schedule configurations, and asset wiring for DAGs beyond their authorized scope. This can lead to unauthorized information disclosure in environments relying on per-DAG read scoping. The Apache Software Foundation recommends upgrading to version 3.2.2 or later to remediate this issue.

An authenticated user with global Asset:read permission can access sensitive information about DAG runs and configurations for DAGs they are not authorized to read. This results in unauthorized information disclosure but does not indicate direct code execution or system compromise. The impact is primarily confidentiality-related within affected Airflow deployments.

Users should upgrade Apache Airflow to version 3.2.2 or later, where this authorization issue has been addressed. No other mitigation or temporary workaround is specified. Patch status is not explicitly stated but the vendor advisory recommends upgrading, indicating an official fix is available in 3.2.2.