Threats tagged 'ghsa-p3v3-229h-mc63'

Apache Airflow versions prior to 3.2.1rc1 have a vulnerability in the authenticated /ui/dags endpoint where per-DAG access control was not enforced on embedded Human-in-the-Loop (HITL) and TaskInstance records. This allowed any authenticated user with read access to at least one DAG to access HITL prompts and full TaskInstance details for DAGs outside their authorized scope, potentially exposing operator parameters and task context data. The issue is fixed in version 3.2.1rc1.