AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowGHSA-gp5f-cx7h-8q6f

Apache Airflow's create action can upsert existing Pools/Connections/Variables

Apache Airflow

CVE-2025-62503 · Published Oct 30, 2025 · updated Jul 7, 2026

Medium4.6
Fix: upgrade to 3.1.1 or later
GitHub advisory

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
>= 3.0.0, < 3.1.13.1.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-250
Also known as
BIT-airflow-2025-62503, CVE-2025-62503, PYSEC-2026-1133

More Apache Airflow advisories

All Apache Airflow
High 7.5Jan 16Apache Airflow proxy credentials for various providers might leak in task logsCVE-2025-68675fixed in 2.11.1 +1Critical 9.8Dec 17, 2025Edge3 Worker RPC RCE on Airflow 2CVE-2025-67895fixed in 2.0.0Medium 6.5Dec 15, 2025Apache Airflow exposes secret values to authenticated UI users via rendered templatesCVE-2025-66388fixed in 3.1.5Medium 5.4Oct 30, 2025Apache Airflow `/api/v2/dagReports` executes DAG Python in APICVE-2025-62402fixed in 3.1.1MediumOct 30, 2025Apache Airflow has a command injection vulnerability in "example_dag_decorator"CVE-2025-54941fixed in 3.0.5MediumSep 26, 2025Apache Airflow: Connection sensitive details exposed to users with READ permissionsCVE-2025-54831fixed in 3.0.4