VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Oct 30, 2025· Updated Jun 17, 2026

CVE-2025-62402

CVE-2025-62402

Description

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
apache-airflowPyPI
>= 3.0.0, < 3.1.13.1.1

Affected products

4
  • Apache/Airflowcpe-rescue2 versions
    3.0.0+ 1 more
    • (no CPE)range: 3.0.0
    • cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*range: >=3.0.0,<3.1.1
  • osv-coords2 versions
    pkg:bitnami/airflowpkg:pypi/apache-airflow
    >= 3.0.0, < 3.1.1+ 1 more
    • (no CPE)range: >= 3.0.0, < 3.1.1
    • (no CPE)range: >= 3.0.0, < 3.1.1

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.