A missing authorization flaw in Apache Airflow allows authenticated users to read, approve, or reject unauthorized Human-in-the-Loop workflows, posing a significant risk to workflow integrity.

This is a missing authorization vulnerability (CWE-862) located in the Execution API's Human-in-the-Loop (HITL) endpoints. The vulnerability allows any authenticated task instance to perform unauthorized read, approval, or rejection actions on HITL workflows belonging to other task instances.

The vulnerability carries a CVSS score of 8.1, reflecting a high severity due to the potential for unauthorized manipulation of business-critical workflows. Successful exploitation could lead to unauthorized data disclosure or the improper execution of automated processes, potentially causing significant operational disruption and data integrity issues.

Immediate Action: Upgrade Apache Airflow to version 3.1.8 or later to incorporate the necessary authorization checks.

Proactive Monitoring: Review audit logs for suspicious activity involving the Execution API or HITL endpoints, specifically monitoring for task instances accessing workflows outside their defined scope.

Compensating Controls: Implement strict network segmentation and ensure that only authorized users or services have the permissions required to interact with the Airflow Execution API.

Public Exploit Available: No.

Given the potential for unauthorized workflow manipulation, this vulnerability should be treated with high priority. Administrators must prioritize the transition to version 3.1.8 to ensure that mandatory authorization controls are enforced across all Human-in-the-Loop endpoints.