QwikSec

Security Database

CVE

CWE

Training

CVE-2025-69219

Published: Mar 9, 2026

Modified: Mar 10, 2026

PUBLISHED

Description

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow Providers Http	affected `5.1.0 - < 6.0.0`

Weaknesses (CWE)

References

https://github.com/apache/airflow/pull/61662

patch

https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.