CVE-2025-62402mediumCWE-250

CVE-2025-62402: falha de média gravidade em Apache Airflow

Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Airflow+ Monitorar apache-airflow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.5%
API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
Apache Software Foundation · Apache Airflow
CVEs relacionadas — Apache Airflow

No mesmo produto, das mais perigosas para as menos.

CVE-2020-11978HIGHCVE-2020-11978EPSS 99.2%KEVCVE-2022-40127HIGHApache Airflow <2.4.0 has an RCE in a bash exampleEPSS 85.7%CVE-2022-45402MEDIUMApache Airflow: Open redirect during loginEPSS 81.1%CVE-2021-38540—Apache Airflow: Variable Import endpoint missed authentication checkEPSS 80.9%CVE-2022-24288—Apache Airflow: RCE in example DAGsEPSS 78.4%CVE-2020-11981—CVE-2020-11981EPSS 36.8%