PT-2026-24022 · Apache · Apache Airflow Ftp Provider

Ahmet Artuç + 2 · Published 2026-03-08 · Updated 2026-03-14 · CVE-2025-69219

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow Providers Http versions prior to 6.0.0

Description A user with database access can create a malicious database entry that executes code on the Triggerer, granting them the same permissions as a Dag Author. Direct database access is not typical for Airflow, reducing the likelihood of exploitation. The issue involves unsafe pickle deserialization in the HttpOperator.

Recommendations Upgrade to version 6.0.0 of the provider to address the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2026-03002

CVE-2025-69219

GHSA-9R5J-7R2X-RV4G

Affected Products

Apache Airflow Ftp Provider

References · 20

• 🔥 https://github.com/sak110/CVE-2025-69219 · Exploit
• 🔥 https://github.com/sak110/CVE-2025-69219/blob/main/poc.py · Exploit
• https://github.com/apache/airflow/pull/61662 · Patch
• https://osv.dev/vulnerability/CVE-2025-69219 · Vendor Advisory
• https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9r5j-7r2x-rv4g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69219 · Security Note
• https://bdu.fstec.ru/vul/2026-03002 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/97839f7b0a8ae66d6079bb7fad5a363068f61617 · Note
• https://reddit.com/r/CVEWatch/comments/1rsj862/top_10_trending_cves_13032026 · Reddit Post
• https://t.me/proxy_bar/3200 · Telegram Post
• http://openwall.com/lists/oss-security/2026/03/09/1 · Note
• https://twitter.com/CVEnew/status/2031122545961844946 · Twitter Post
• https://t.me/CVEtracker/46892 · Telegram Post