CVE-2025-62402

Published: Oct 30, 2025

Modified: Feb 26, 2026

PUBLISHED

Description

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	affected `3.0.0 - < 3.1.1`

Weaknesses (CWE)

CWE-250

References

https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-62402

Description

Affected Products

Weaknesses (CWE)

References