CVE-2025-69219

HIGH

8.8

Descricao

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado3/9/2026

Ultima modificacao3/10/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

apache:airflow_providers_http

Fraquezas (CWE)

CWE-913

Referencias

https://github.com/apache/airflow/pull/61662(security@apache.org)

https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0(security@apache.org)

http://www.openwall.com/lists/oss-security/2026/03/09/1(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.