Threats tagged 'ghsa-r5cg-4fxg-38f2'

Apache Airflow's public Import Errors API exposes raw parse-failure stack traces to any user with the ImportError.can_read permission when the failing file has no registered DAG. This can reveal sensitive information such as file paths and code to unauthorized users. The issue is addressed in Apache Airflow 3.4.0 and later by restricting stack trace visibility to users with the new IMPORT_ERRORS_ALL permission.