CVE-2025-69219

Published: Mar 9, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

Affected (1)

Products: Apache: Airflow Providers Http

1 product

Airflow Providers Http

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Airflow Providers Http	From 5.1.0 to 6.0.0

Related CWEs

Improper Control of Dynamically-Managed Code Resources

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References (3)

https://github.com/apache/airflow/pull/61662

Source: security@apache.org

Issue TrackingPatch

https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0

Source: security@apache.org

Mailing List

http://www.openwall.com/lists/oss-security/2026/03/09/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.