JWT tokens used by Apache Airflow tasks were recorded in log files. Anyone who can read these logs, such as a UI user, would obtain a token that grants the authority of a Dag Author. Using that token, an attacker could create, modify, or delete DAG definitions, potentially injecting malicious code or causing unauthorized data processing.

The vulnerability affects installations of Apache Airflow maintained by the Apache Software Foundation. Versions prior to 3.2.0 have not applied the fix, so any release older than 3.2.0 is susceptible.

The EPSS score is < 1%, indicating a low likelihood of exploitation, and the issue is not listed in the KEV catalog, so official exploitation data is sparse. The attack vector is inferred to be through the Airflow UI or any process that reads the application logs; thus, individuals with log access pose a risk. The CVSS score is 7.5, reflecting a moderate to high impact if exploited.