Description
A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low.
You should upgrade to version 6.0.0 of the provider to avoid even that risk.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow Providers Http | 5.1.0 – < 6.0.0 | 6.0.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.1.8-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
sak110/CVE-2025-69219 ★ 7 · Mar 11, 2026
-
ahmetartuc/poc-cve-2025-69219 ★ 1 · Feb 11, 2026
cve-2025-69219
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow-providers-http | < 6.0.0 | 6.0.0 | GHSA-9r5j-7r2x-rv4g |
Advisories 1
- WID-SEC-2026-0636 Apache Airflow: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Mar 9, 2026