PUBLISHED
2025-10-30 10:15
MODIFIED
2025-10-30 10:15
EPSS (Prob. Exploit)
0.52%
Top 55.5%
> DESCRIPTION
API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-250: Execution with Unnecessary Privileges - The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
> GITHUB SECURITY ADVISORY
GHSA-273c-4g26-4jpm
MODERATE
Apache Airflow `/api/v2/dagReports` executes DAG Python in API
AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.0.0, < 3.1.1
Fixed in: 3.1.1
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
ALIASES:
BIT-airflow-2025-62402, GHSA-273c-4g26-4jpm, PYSEC-2026-1129
> HISTORIQUE DES MODIFICATIONS
Première apparition
30/10/2025 10:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:36
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/11/2025 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-250: Execution with Unnecessary Privileges - The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the co...
Total des modifications: 2
Dernière mise à jour: 9 months ago