CVE-2025-62503: Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62503?
CVE-2025-62503 is classified as a high severity vulnerability due to the potential for unauthorized data manipulation.
How do I fix CVE-2025-62503?
To fix CVE-2025-62503, ensure that user roles are configured correctly to restrict the CREATE and UPDATE privileges for Pools, Connections, and Variables.
What is the impact of CVE-2025-62503 on Apache Airflow?
The impact of CVE-2025-62503 on Apache Airflow is that users can exploit the bulk create API to overwrite existing records without the necessary updates privilege.
Who is affected by CVE-2025-62503?
Any user with CREATE privileges but lacking UPDATE privileges for Pools, Connections, and Variables in Apache Airflow is affected by CVE-2025-62503.
Is there a workaround for CVE-2025-62503?
A potential workaround for CVE-2025-62503 is to temporarily restrict access to the bulk create API until proper user role reviews and adjustments are made.