Apache Airflow 3.0.0's Log server incorrectly authorizes JWT tokens by applying Python's str.lstrip() to the requested path segment when verifying the JWT's 'sub' claim. Since str.lstrip() removes any characters from a set rather than a prefix, a JWT issued for a Dag named 'dag_a' could authorize access to logs of other Dags whose names begin with any subset of the characters {d, a, g, _}. This flaw enables an authenticated Airflow worker holding a valid Log-server JWT to enumerate and read logs of other Dags beyond the intended per-Dag isolation boundary, potentially leaking sensitive task output and error traces. The vulnerability affects environments using per-Dag log-access scoping, such as multi-team or shared-executor topologies. Users are advised to upgrade to Apache Airflow 3.2.2 or later to address this issue.

An authenticated Airflow worker with a valid Log-server JWT for one Dag can access logs of other Dags whose names share characters from the original Dag's name due to improper authorization checks. This leads to unauthorized information disclosure of task outputs and error traces beyond the intended isolation boundaries. The impact is limited to information disclosure (confidentiality) and does not affect integrity or availability. The vulnerability requires low privileges (authenticated worker) and has a low CVSS score of 3.1.

Users should upgrade Apache Airflow to version 3.2.2 or later, where this authorization flaw is fixed. No other official remediation or temporary workaround is provided. Patch status is not explicitly stated in the vendor advisory content, but the recommendation to upgrade to 3.2.2 or later indicates an official fix is available in those versions.