Hussein Awala

The issue is related to the deserialization mechanism in Apache Airflow, allowing a potential attacker to poison the XCom data by bypassing the protection of the `enable xcom pickling=False` configuration setting, resulting in poisoned data after XCom deserialization. This issue is considered low severity as it requires a DAG author to exploit it.

The Airflow worker serializes a Kubernetes configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption when using deferrable mode. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. The configuration dictionary will be logged as plain text in the triggerer service without masking for Airflow versions between 2.3.0 and 2.6.0.

The issue is related to insufficient protection of internal data in Apache Airflow, allowing an authorized user with limited access to read specific DAGs to also read information about task instances in other DAGs. This can lead to unauthorized access to protected information.

The issue allows an authenticated user to retrieve sensitive configuration information when the `expose config` option is set to "non-sensitive-only". The `expose config` option is False by default. Approximately 39,118 devices may be affected.

The issue allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs, revealing the `dag ids` and the stack-traces of import errors for those DAGs with import errors.