Ephraim Anierobi

The Apache Airflow Git provider performs git-over-SSH operations with `StrictHostKeyChecking=no` by default, which disables SSH host-key verification. This allows an attacker capable of intercepting the network path between an Airflow worker and the Git server to perform a man-in-the-middle attack. Such an attack could lead to the capture of the SSH deploy key or the injection of malicious repository content. This issue affects deployments utilizing the Git DAG bundle or Git provider to clone over SSH using a deploy key.

The issue is related to improper access control in Apache Airflow, allowing an authenticated user without the variable edit permission to update a variable. This compromises the integrity of variable management and could lead to unauthorized data modification.

The issue allows an authorized user with access to read specific DAGs only to read information about task instances in other DAGs. This is due to a lack of protection for internal data. Exploitation of this issue may allow a remote attacker to gain read access to data.

The issue allows an unauthorized actor to gain access to sensitive information in the Connection edit view. This is considered a low-risk vulnerability as it requires access to Connection resources and specific actions to exploit.