Apache Airflow's create action can upsert existing Pools/Connections/Variables

MEDIUM 4.6CVE-2025-62503 · BIT-airflow-2025-62503 · GHSA-gp5f-cx7h-8q6f · Published 30/10/2025 · updated 08/10/2026

In short

CVE-2025-62503 is a MEDIUM (CVSS 4.6) vulnerability affecting apache-airflow, airflow (apache).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.7% of all vulnerabilities.
Fix: update to 3.1.1 or later.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 3.0.0, < 3.1.1`	`3.1.1`
airflow apache	`≥ 3.0.0, < 3.1.1`	`3.1.1`

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 3.0.0, < 3.1.1

3.1.1

≥ 3.0.0, < 3.1.1

3.1.1

Description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

More vulnerabilities in apache-airflow

See all →