Apache Airflow's create action can upsert existing Pools/Connections/Variables

MEDIO 4.6CVE-2025-62503 · BIT-airflow-2025-62503 · GHSA-gp5f-cx7h-8q6f · Published 30/10/2025 · updated 08/10/2026

En resumen

CVE-2025-62503 es una vulnerabilidad MEDIO (CVSS 4.6) que afecta a apache-airflow, airflow (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.43%, mayor que el 37.7% de las vulnerabilidades.
Solución: actualizar a 3.1.1 o posterior.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 3.0.0, < 3.1.1`	`3.1.1`
airflow apache	`≥ 3.0.0, < 3.1.1`	`3.1.1`

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 3.0.0, < 3.1.1

3.1.1

≥ 3.0.0, < 3.1.1

3.1.1

Description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Más vulnerabilidades de apache-airflow

Ver todo →