Apache Airflow `/api/v2/dagReports` executes DAG Python in API

보통 5.4CVE-2025-62402 · BIT-airflow-2025-62402 · GHSA-273c-4g26-4jpm · Published 30/10/2025 · updated 08/10/2026

요약

CVE-2025-62402은(는) apache-airflow, airflow (apache)에 영향을 주는 보통 (CVSS 5.4) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.52%, 전체 취약점의 44.3%보다 높음.
조치: 3.1.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
apache-airflow PyPI	`≥ 3.0.0, < 3.1.1`	`3.1.1`
airflow apache	`≥ 3.0.0, < 3.1.1`	`3.1.1`

Description

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

NVD description

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

References

nvd.nist.gov/vuln/detail/CVE-2025-62402 · ADVISORY
apache/airflow#56609 · WEB
apache/airflow commit 828aaa0 · WEB
apache/airflow · PACKAGE
lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs · WEB
openwall.com/lists/oss-security/2025/10/29/7 · WEB
pypi.org/project/apache-airflow · PACKAGE
GitHub Advisory GHSA-273c-4g26-4jpm · ADVISORY

apache-airflow의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

≥ 3.0.0, < 3.1.1

3.1.1

airflow

apache

≥ 3.0.0, < 3.1.1

3.1.1

Description

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

NVD description

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

apache-airflow의 다른 취약점

모두 보기 →