apache/airflow · Security
Apache Airflow's create action can upsert existing Pools/Connections/Variables
- GHSA ID
- GHSA-gp5f-cx7h-8q6f
- CVE ID
- CVE-2025-62503
- Severity
- medium
- Published
- Updated
- CVSS
- 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- CVSS v3
- 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Description
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
CWEs
- CWE-250 · Execution with Unnecessary Privileges