GHSA-273c-4g26-4jpm

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

En bref

Publiée: 2025-10-30 12:31 UTC
Mise à jour: 2026-07-07 17:56 UTC
CVE: CVE-2025-62402
Alias: BIT-airflow-2025-62402, PYSEC-2026-1129
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

Paquets affectés

Paquet	Versions
PyPI · apache-airflow	introduced 3.0.0, fixed 3.1.1

Références

https://nvd.nist.gov/vuln/detail/CVE-2025-62402 ADVISORY
https://github.com/apache/airflow/pull/56609 WEB
https://github.com/apache/airflow/commit/828aaa0b1d95caf90612a648867c17aec7e87874 WEB
https://github.com/apache/airflow PACKAGE
https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs WEB
http://www.openwall.com/lists/oss-security/2025/10/29/7 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database