Apache Airflow versions 3.0.0 up to but not including 3.1.1 contain a vulnerability in the `/api/v2/dagReports` API endpoint that allows API users to execute DAG Python code in the context of the API server if the server has access to DAG files. This could lead to unauthorized code execution. The issue is fixed in version 3.1.1.