p PatchFirst

CVE-2025-62402

CVE-2025-62402 · Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

This page contains facts from public vulnerability sources. Check the original advisory before updating.

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

CVSS 5.4 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache airflow

    Versions
    • ≥ 3.0.0, < 3.1.1: Affected (semver)

    Update to 3.1.1

  • apache-airflow PyPI

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.1rc1
    • 3.0.2
    • 3.0.2rc1
    • 3.0.2rc2
    • 3.0.3
    • 3.0.3rc1
    • 3.0.3rc2
    • 3.0.3rc3
    • 3.0.3rc4
    • 3.0.3rc5
    • 3.0.3rc6
    • 3.0.4
    • 3.0.4rc1
    • 3.0.4rc2
    • 3.0.5
    • 3.0.5rc1
    • 3.0.5rc2
    • 3.0.5rc3
    • 3.0.6
    • 3.0.6rc1
    • 3.0.6rc2
    • 3.1.0
    • 3.1.0b1
    • 3.1.0b2
    • 3.1.0rc1
    • 3.1.0rc2
    • 3.1.1rc1
    • 3.1.1rc2
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.1.1

    Update to 3.1.1

Original sources

Check your server →