In Apache Airflow < 1.10.12, the origin parameter passed to some of the endpoints like /trigger and was vulnerable to a XSS exploit.
origin
/trigger