CVE-2025-62402

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - security@apache.org

Published

2025-10-30

Last modified

2026-10-08

Weaknesses

CWE-250

Affected products

• Airflow (Apache)
• Apache Airflow (Apache Software Foundation)

References

• https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs
• http://www.openwall.com/lists/oss-security/2025/10/29/7