The vulnerability allows the exposure of full exception stack traces when SQL constraint errors occur, even though the Airflow configuration option to hide stack traces is set to false. This behavior leaks implementation details and potentially sensitive database information, which can aid attackers in crafting further exploits. The weakness is a classic example of CWE‑668: sensitive information leakage. Based on the description, it is inferred that the attack vector is through Airflow’s REST API when a user triggers a SQL constraint error.

All Apache Airflow deployments that do not use the patched version released in 3.2.0 are affected, as the defect existed in all previous releases. The advisory explicitly recommends upgrading to Apache Airflow 3.2.0 or later to eliminate the exposed stack traces.

The CVSS score of 7.5 places this vulnerability in the high severity range. The EPSS score indicates very low exploitation probability, below 1%, and it is not listed in the CISA KEV catalog. The weakness can be exploited by sending a request that triggers a SQL constraint error via Airflow’s REST API, resulting in the unintended disclosure of exception stack traces even when the api/expose_stack_traces setting is disabled. The likely attack vector is through Airflow’s REST API when a user triggers a SQL constraint error. Because the information revealed includes implementation details and potentially sensitive database content, an attacker could use this data to facilitate further attacks.