[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAH5JyZo25yGTn9S2tc7TyXrh9q2Tuph0y2+Dc7FRVZb9Au2QJQ@mail.gmail.com>
Date: Wed, 29 Oct 2025 19:55:30 +0000
From: Kaxil Naik <kaxilnaik@...il.com>
To: oss-security@...ts.openwall.com
Cc: dev@...flow.apache.org, users@...flow.apache.org
Subject: CVE-2025-62402: Apache Airflow: Airflow 3 API: /api/v2/dagReports
executes DAG Python in API
Severity: moderate
Affected versions:
- Apache Airflow (apache-airflow) >=3.0.0,<3.1.1
Description:
API users via `/api/v2/dagReports` could perform Dag code execution in
the context of the api-server if the api-server was deployed in the
environment where Dag files were available.
Credit:
kwkr (https://github.com/kwkr) (reporter)
References:
https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-62402
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
