CVE-2025-67895: Apache Airflow Edge3 Provider Remote Code Execution Vulnerability
Summary
CVE-2025-67895: Edge3 Worker RPC RCE on Airflow 2. Affects apache-airflow versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Also tracked for
The same CVE-2025-67895 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) of tasks. The Edge3 provider, which is a component of Airflow, has been primarily in development and not officially released, leading to potential security risks when improperly configured.
Vulnerability Detail
The vulnerability arises from the Edge3 provider for Apache Airflow 2, which, if installed and configured, enabled a non-public API intended for development testing. This API inadvertently allowed DAG authors to execute arbitrary code in the webserver context, leading to Remote Code Execution (RCE). The issue is particularly critical as it exposes the webserver to unauthorized actions that could compromise the entire system.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to uninstall the vulnerable provider and upgrade to the latest version of Airflow.
Conclusion
The CVE-2025-67895 vulnerability in the Apache Airflow Edge3 provider poses a significant risk of Remote Code Execution if the provider is improperly configured. Users are strongly advised to uninstall the vulnerable version and upgrade to Airflow 3 to ensure their systems remain secure.
See every vulnerability recorded for apache-airflow →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Apache Airflow versions prior to 2.0.0 that have the Edge3 provider installed and configured are affected.
You should uninstall the Edge3 provider from Airflow 2 and migrate to Airflow 3 to eliminate the risk.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The Edge3 provider is intended to facilitate integration with Edge3 services within Apache Airflow workflows, but it was primarily in a development phase and not officially released.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
