CVE-2025-62402: Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62402?
CVE-2025-62402 is classified as a critical vulnerability due to the potential for unauthorized code execution.
How do I fix CVE-2025-62402?
To remediate CVE-2025-62402, ensure that the API server is not deployed in an environment where Dag files are accessible.
Who is affected by CVE-2025-62402?
CVE-2025-62402 affects users of Apache Airflow version 3 that have the API endpoint `/api/v2/dagReports` exposed.
What types of attacks can be performed using CVE-2025-62402?
Attackers can perform unauthorized Dag code execution, potentially leading to data breaches or service disruptions.
When was CVE-2025-62402 disclosed?
CVE-2025-62402 was disclosed in October 2025.