Tenable Research has identified a critical vulnerability within the AWS Managed Workflows for Apache Airflow (MWAA) service, which they have named “FlowFixation.” This vulnerability could have permitted attackers to execute a one-click takeover of a user’s web management panel for their Airflow instance. The discovery underscores the ongoing issue of misconfigured shared-parent domains, a problem that poses a significant threat to customers of major cloud service providers (CSPs).

Source: GBHackers