API Code Execution Vulnerability in Apache Airflow
CVE-2025-62402

5.4MEDIUM

Key Information:

Vendor

Apache
Status
Apache Airflow
Vendor
CVE Published:
30 October 2025

What is CVE-2025-62402?

The vulnerability allows API users to execute arbitrary Dag code within the context of the API server. If the API server is configured in an environment where Dag files are accessible, this could lead to unauthorized manipulation of workflows and execution of untrusted code, potentially compromising the integrity of the system and its data.

Affected Version(s)

Apache Airflow 3.0.0 < 3.1.1

References

https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kwkr (https://github.com/kwkr)
JSON
.
CVE-2025-62402 : API Code Execution Vulnerability in Apache Airflow