Medium WID-SEC-2026-0636 1 CVE

Apache Airflow: Schwachstelle ermöglicht Codeausführung

Published Mar 8, 2026 · Updated Mar 9, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Airflow Platform: Linux

Summary

Ein Angreifer kann eine Schwachstelle in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 1

High 8.8

CVE-2025-69219 Public exploit

Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the like…

Apache Software Foundation Apache Airflow Providers Http airflow-3 apache-airflow-providers-http Wolfi PyPI

Mar 9, 2026

Revision history

2026-03-09 #2
Referenz(en) aufgenommen: EUVD-2025-208401, EUVD-2025-208402
2026-03-08 #1
Initiale Fassung

References

Apache Pony Mail vom 2026-03-08
https://lists.apache.org/thread/bon39m7hy3myvxlnj90k07m22ofh7zm4
OSS Security Mailing List vom 2026-03-08
https://seclists.org/oss-sec/2026/q1/282