Apache Airflow's create action can upsert existing Pools/Connections/Variables

MEDIO 4.6CVE-2025-62503 · BIT-airflow-2025-62503 · GHSA-gp5f-cx7h-8q6f · Published 30/10/2025 · updated 08/10/2026

In breve

CVE-2025-62503 è una vulnerabilità MEDIO (CVSS 4.6) che riguarda apache-airflow, airflow (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.43%, superiore al 37.7% delle vulnerabilità.
Correzione: aggiornare a 3.1.1 o successiva.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 3.0.0, < 3.1.1`	`3.1.1`
airflow apache	`≥ 3.0.0, < 3.1.1`	`3.1.1`

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 3.0.0, < 3.1.1

3.1.1

≥ 3.0.0, < 3.1.1

3.1.1

Description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

NVD description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Altre vulnerabilità di apache-airflow

Vedi tutto →