PUBLISHED
2025-10-30 10:15
MODIFIED
2025-10-30 10:15
EPSS (Prob. Exploit)
0.43%
Top 62.1%
> DESCRIPTION
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-250: Execution with Unnecessary Privileges - The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)
ALIASES:
BIT-airflow-2025-62503, GHSA-gp5f-cx7h-8q6f, PYSEC-2026-1133
> HISTORIQUE DES MODIFICATIONS
Première apparition
30/10/2025 10:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:36
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/11/2025 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-250: Execution with Unnecessary Privileges - The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the co...
Total des modifications: 2
Dernière mise à jour: 9 months ago