Only Apache Airflow 3.3.0 deployments with the non-default [core] test_connection setting enabled are affected. Airflow 3.4.0 and later are not listed as affected.
The attacker needs permission to create connections but not necessarily permission to edit them. They must queue an asynchronous connection test for an ID that does not yet exist, then another connection must be created under that same ID before the test completes.
When the asynchronous test completes with commit_on_success, it can write the tested connection under the shared ID and overwrite the connection created in the interim. This bypasses the intended edit authorization for the later-created connection.
Disable the non-default [core] test_connection setting if operationally feasible. The advisory identifies this setting as a prerequisite for exposure; otherwise, upgrade to Apache Airflow 3.4.0 or later.