CVE-2025-62503
CVE-2025-62503 · Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
CVSS 4.6 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
apache airflow
- Versions
- ≥ 3.0.0, < 3.1.1: Affected (semver)
Update to 3.1.1
apache-airflow PyPI
- Versions
- 3.0.0
- 3.0.1
- 3.0.1rc1
- 3.0.2
- 3.0.2rc1
- 3.0.2rc2
- 3.0.3
- 3.0.3rc1
- 3.0.3rc2
- 3.0.3rc3
- 3.0.3rc4
- 3.0.3rc5
- 3.0.3rc6
- 3.0.4
- 3.0.4rc1
- 3.0.4rc2
- 3.0.5
- 3.0.5rc1
- 3.0.5rc2
- 3.0.5rc3
- 3.0.6
- 3.0.6rc1
- 3.0.6rc2
- 3.1.0
- 3.1.0b1
- 3.1.0b2
- 3.1.0rc1
- 3.1.0rc2
- 3.1.1rc1
- 3.1.1rc2
- Affected ranges
- ECOSYSTEM: ≥ 3.0.0, < 3.1.1
Update to 3.1.1