Parameter Validation Issue in Apache Airflow Affects Custom DAGs

CVE-2025-54941

What is CVE-2025-54941?

A vulnerability in Apache Airflow's example_dag_decorator allows for parameter manipulation, potentially leading to unauthorized redirection of users to malicious servers and executing arbitrary code on worker nodes. This issue arises when example DAGs are enabled in production or their code is replicated for custom use. Users who leverage the example_dag_decorator should carefully review their implementation and apply the mitigation measures as outlined in Airflow version 3.0.5.

References