CVE-2025-62503

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +18 more potentially affected by CVE-2025-62503 via apache-airflow-core (>=3.0.0, <=3.1.1rc2)

apache-airflow-core PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2025-62503 Source advisory: MEND:CVE-2025-62503...

CVE-2025-62503 Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action...