PT-2025-51824 · Unknown+1 · Apache Airflow+1

Jarek Potiuk + 1 · Published 2025-12-17 · Updated 2025-12-26 · CVE-2025-67895

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow Providers Edge3 versions prior to 2.0.0

Description The Edge3 provider for Apache Airflow 2 contains an issue that allows a Dag author to perform Remote Code Execution (RCE) in the webserver context through a non-public API. This API was intended for testing the Edge Provider during development and was implicitly enabled when the Edge3 provider was installed and configured on Airflow 2. The Edge3 provider support in Airflow 2 was development-only and not officially released. The issue is present only if the Edge3 provider was installed and configured on Airflow 2.

Recommendations If you installed and configured the Edge3 provider for Airflow 2, uninstall it and migrate to Airflow 3. If you used the Edge Provider in Airflow 3, you are not affected.

Fix

RCE

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2025-67895

GHSA-66H8-3G48-6HX8

PYSEC-2025-87

Affected Products

Apache Airflow

Edge3

References · 15

• https://github.com/apache/airflow/pull/59143 · Patch
• https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-87 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67895 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66h8-3g48-6hx8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67895 · Security Note
• https://github.com/apache/airflow · Note
• https://t.me/CVEtracker/40045 · Telegram Post
• https://t.me/cveNotify/146076 · Telegram Post
• https://t.me/cveNotify/146566 · Telegram Post
• https://twitter.com/cracbot/status/2003057981789995421 · Twitter Post
• https://t.me/cveNotify/146071 · Telegram Post
• http://openwall.com/lists/oss-security/2025/12/16/3 · Note
• https://twitter.com/oss_security/status/2004414625740357883 · Twitter Post
• https://twitter.com/CVEnew/status/2001350812531089589 · Twitter Post