Security vulnerability affects the airflow-3 package. Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill id path segment failed to parse.