CVE-2025-62503

Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

State: Published
Severity: 4.6 Medium
Published: Oct 30, 2025
Updated: Oct 30, 2025
Reserved: Oct 15, 2025

Description

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Scores

CVSS	Score	Vector	Source
3.1	4.6 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N	CISA-ADP

Weaknesses

CWE-250 Execution with Unnecessary Privileges

Affected Products

Product	Versions
Apache AirflowApache Software Foundation	3.0.0 to before 3.1.1Affected

References

https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcrvendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.