CVE-2025-62402
Medium · 5.4Apache Airflow `/api/v2/dagReports` executes DAG Python in API
CVSS
5.4
EPSS
0.5%
Published
Oct 30, 2025
CISA due date
—
The record
API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | apache-airflow | 3.0.0 | 3.1.1 |
| Bitnami | airflow | 3.0.0 | 3.1.1 |
| pypi | apache-airflow | 3.0.0 | No fix |
Related vulnerabilities
- GHSA-273c-4g26-4jpm Apache Airflow `/api/v2/dagReports` executes DAG Python in API Same vulnerability
- GHSA-8r55-rv5w-6pfm Apache Airflow exposes sensitive information in its log files Also affects apache-airflow
- GHSA-r837-hpv7-pc2f Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate… Also affects apache-airflow
- CVE-2024-56373 DAG Author (who already has quite a lot of permissions) could manipulate database of… Also affects apache-airflow
- CVE-2025-27555 Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with… Also affects apache-airflow
- GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs Also affects apache-airflow
- CVE-2025-65995 When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the… Also affects apache-airflow
- GHSA-5g2w-9f8g-g5q7 Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users Also affects apache-airflow