Apache Airflow's create action can upsert existing Pools/Connections/Variables

MOYENNE 4.6CVE-2025-62503 · BIT-airflow-2025-62503 · GHSA-gp5f-cx7h-8q6f · Published 30/10/2025 · updated 08/10/2026

En bref

CVE-2025-62503 est une vulnérabilité MOYENNE (CVSS 4.6) touchant apache-airflow, airflow (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.43%, plus élevée que 37.7% des vulnérabilités.
Correctif : mettre à jour vers 3.1.1 ou plus récent.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 3.0.0, < 3.1.1`	`3.1.1`
airflow apache	`≥ 3.0.0, < 3.1.1`	`3.1.1`

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 3.0.0, < 3.1.1

3.1.1

≥ 3.0.0, < 3.1.1

3.1.1

Description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Autres vulnérabilités de apache-airflow

Tout voir →