A user who has read permission on any DAG can retrieve the entire source file that contains that DAG through the GET /api/v2/dagSources/{dag_id} endpoint or the equivalent graphical view. The response is not filtered by the intended per‑DAG access policy, so code for DAGs that the caller is not allowed to see is also returned. This bypass is an instance of improper authorization (CWE‑639) that lets the attacker gain visibility into source code that should remain confidential.

The flaw affects all installations of Apache Airflow that run any version earlier than 3.3.0 and that define multiple DAGs within a single Python file. Systems that keep one DAG per file are not impacted, and any deployment running 3.3.0 or later is already fixed.

An attacker must be authenticated and hold read access to at least one DAG in the file; once those conditions are met, the vulnerability can be exercised through the REST API or the web UI. The CVSS score of 6.5 reflects a moderate impact on confidentiality. The EPSS score of less than 1% indicates a low probability of widespread exploitation, and the weakness is not listed in the CISA KEV catalog.