The vulnerability stemmed from the trigger endpoint accepting GET requests for DAG execution. The GitHub patch shows the critical change in views.py where the condition was modified from checking only GET method to a more restrictive check, forcing POST-based execution. The HTML template changes (adding onclick handlers using POST) and test adjustments (adding POST data) further confirm that GET-based triggering was the vulnerable pattern. The core vulnerability resided in the trigger view's handling of GET requests without CSRF protections.