Remote Code Execution (RCE)

Apache Airflow Providers Edge3 is vulnerable to Remote Code Execution RCE. The vulnerability is due to exposure of a non-public Worker RPC API enabled when the Edge3 provider was installed on Airflow 2, where development-only APIs intended for internal testing allowed DAG authors to execute...

Incorrect Resource Transfer Between Spheres

Overview apache-airflow-providers-edge3 is a Provider package apache-airflow-providers-edge3 for Apache Airflow Affected versions of this package are vulnerable to Incorrect Resource Transfer Between Spheres via the Edge3 Worker RPC. An attacker can execute arbitrary code in the web-server contex...

CVE-2025-67895

The Apache Airflow Providers Edge3 component is vulnerable to Remote Code Execution (RCE) in the webserver context when installed and configured on Airflow 2 (versions before 2.0.0). The root cause is the implicit exposure of a non-public, development-only Worker RPC API used for testing, which a...