CVE-2025-69219

Katalog CVE

CVSS 8.8 · High EPSS 0,71%

Kerentanan Improper Control of Dynamically-Managed Code Resources pada apache airflow providers http. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-913: Improper Control of Dynamically-Managed Code Resources

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apache/airflow/pull/61662 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/03/09/1 mailing list · advisory pihak ketiga
• https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0 mailing list