Code Execution Vulnerability in Apache Airflow by Apache Software Foundation

CVE-2026-25917

What is CVE-2026-25917?

In Apache Airflow, a vulnerability exists that allows Dag Authors, trusted users typically not authorized to execute code in a webserver context, to craft payloads that could lead to arbitrary code execution. This poses a significant risk as Dag Authors already have elevated privileges. Users should upgrade to Apache Airflow version 3.2.0 or later to mitigate the vulnerability and enhance their application's security. For more details, refer to the patch in Apache Airflow PR #61641 and the vendor advisory.

References