The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
Workaround:
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.