CVE-2025-62402: Apache Airflow DAG Code Execution Vulnerability in API
Summary
CVE-2025-62402: Apache Airflow /api/v2/dagReports executes DAG Python in API. Affects apache-airflow versions >= 3.0.0, < 3.1.1. Fixed in 3.1.1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2025-62402 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) using Python code. The platform is widely used for orchestrating complex data workflows and automating data processing tasks. However, a vulnerability has been identified in the API endpoint '/api/v2/dagReports', which can lead to unauthorized execution of DAG code in the context of the API server if the server is deployed in an environment where DAG files are accessible.
Vulnerability Detail
The vulnerability arises from the '/api/v2/dagReports' endpoint, which allows API users to execute DAG code directly on the server. This can lead to unauthorized access and execution of potentially harmful code, as the API server operates with the same permissions as the DAG files. If an attacker can manipulate the API requests, they could execute arbitrary Python code, compromising the integrity and security of the server. This vulnerability is classified under CWE-250, which pertains to execution of code via an API without proper authorization.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the '/api/v2/dagReports' endpoint by implementing proper authentication and authorization mechanisms. Ensure that only trusted users have access to the API and consider disabling the endpoint if it is not needed.
Conclusion
The CVE-2025-62402 vulnerability in Apache Airflow poses significant risks due to the potential for unauthorized code execution via the API. It is crucial for users to update to the patched version 3.1.1 or implement workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2025-62402 is a vulnerability in Apache Airflow that allows unauthorized execution of DAG code through the '/api/v2/dagReports' endpoint.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized code execution, data breaches, and potential compromise of the API server's integrity.
You can update Apache Airflow by running the command 'pip install --upgrade apache-airflow' to ensure you are using version 3.1.1 or later.
Vulert monitors and alerts for open-source vulnerabilities in software using just the Pipfile.lock. It provides real-time alerts for vulnerabilities without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
