Skip to content
CVE PROGRAM SOURCE RECORD4.6 Medium

CVE-2025-62503

Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Airflow

Default version status: unaffected

  • 3.0.0 to < 3.1.1affected

References