An authenticated Airflow user with read access to at least one DAG can call the /ui/dags endpoint and retrieve Human‑in‑the‑Loop prompts, including request parameters, as well as full TaskInstance details for DAGs that the user is not authorized to view. The exposed data often contains operator parameters and contextual information, increasing visibility of DAG run data beyond the intended per‑DAG RBAC boundaries.

Apache Software Foundation’s Apache Airflow is affected. Versions prior to 3.2.1 are vulnerable; upgrading to 3.2.1 or later applies the fix that enforces per‑DAG access control on the /ui/dags endpoint.

The vulnerability carries a CVSS score of 4.3, indicating moderate risk. The EPSS score is below 1%, suggesting a low probability of exploitation at any given time, and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be authenticated, as the endpoint requires a logged‑in user with DAG read permission. An attacker would need legitimate Airflow credentials and permission to any DAG to exploit the weakness, after which they could read data for DAGs outside their scope.