Apache Airflow's create action can upsert existing Pools/Connections/Variables

MITTEL 4.6CVE-2025-62503 · BIT-airflow-2025-62503 · GHSA-gp5f-cx7h-8q6f · Published 30/10/2025 · updated 08/10/2026

Kurz gesagt

CVE-2025-62503 ist eine Schwachstelle (MITTEL (CVSS 4.6)) in apache-airflow, airflow (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.43%, höher als bei 37.7% aller Schwachstellen.
Abhilfe: auf 3.1.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 3.0.0, < 3.1.1`	`3.1.1`
airflow apache	`≥ 3.0.0, < 3.1.1`	`3.1.1`

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 3.0.0, < 3.1.1

3.1.1

≥ 3.0.0, < 3.1.1

3.1.1

Description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Weitere Schwachstellen in apache-airflow

Alle anzeigen →