airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +18 more potentially affected by CVE-2025-62402 via apache-airflow (>=3.0.0, <=3.1.0)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2025-62402 Source advisory: OSV:PYSEC-2026-1129...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +18 more potentially affected by CVE-2025-62402 via apache-airflow (>=3.0.0, <=3.1.0)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2025-62402 Source advisory: GHSA-273C-4G26-4JPM...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +18 more potentially affected by CVE-2025-62402 via apache-airflow (>=3.0.0, <=3.1.0)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2025-62402 Source advisory: OSV:GHSA-273C-4G26-4JPM...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +18 more potentially affected by CVE-2025-62402 via apache-airflow (>=3.0.0, <=3.1.0)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2025-62402 Source advisory: MEND:CVE-2025-62402...

CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +18 more potentially affected by CVE-2025-62402 via apache-airflow-core (>=3.0.0, <=3.1.1rc2)

apache-airflow-core PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2025-62402 Source advisory: MEND:CVE-2025-62402...

CVE-2025-62402

In Apache Airflow , API users can perform DAG code execution within the context of the api-server via the /api/v2/dagReports interface. This vulnerability occurs if the api-server is deployed in an environment where DAG files are accessible. This flaw can potentially lead to remote code execution...

CVE-2025-62402

creationtimestamp| type| source ---|---|--- 2025-10-29 19:33:03+00:00| seen| https://seclists.org/oss-sec/2025/q4/100 2025-10-29 21:09:47+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m4eeape4oa2s 2025-10-30 12:00:40+00:00| seen|...