A flaw in the login redirect logic of Apache Airflow allows authenticated users to craft URLs that bypass the is_safe_url check, resulting in an open redirect from a trusted Airflow domain to an attacker-controlled origin. This can potentially be leveraged for malicious activities such as phishing or credential theft.

The vulnerability affects any installation of Apache Airflow running a version earlier than 3.2.2. Users should verify the currently installed version and plan an upgrade to 3.2.2 or newer to receive the patched redirect logic.

The CVSS score of 7.2 indicates medium‑to‑high severity, while the EPSS score is less than 1% and the flaw is not listed in CISA’s KEV catalog, which suggests a low likelihood of exploitation. Attackers must be authenticated but do not need elevated privileges. Based on the description, it is inferred that once the redirect bypass is achieved, the attacker can redirect users to malicious domains, potentially enabling phishing or credential harvesting. The exploit is straightforward for compromised or target accounts.