CVE-2025-62402: 
Apache Airflow vulnerability analysis and mitigation

A vulnerability identified as CVE-2025-62402 was discovered in Apache Airflow versions 3.0.0 to 3.1.1. The vulnerability was disclosed on October 29, 2025, and affects the API endpoint /api/v2/dagReports. The issue was discovered by security researcher kwkr and was classified with moderate severity (OSS Security).

The vulnerability is classified as CWE-250 (Execution with Unnecessary Privileges) and received a CVSS 3.1 Base Score of 5.4 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The technical issue involves the potential for API users to execute DAG (Directed Acyclic Graph) code through the /api/v2/dagReports endpoint when the api-server is deployed in an environment where DAG files are accessible (NVD).

The vulnerability allows authenticated API users to execute DAG Python code in the context of the api-server, potentially leading to unauthorized code execution when DAG files are present in the deployment environment (OSS Security).

The vulnerability affects Apache Airflow versions from 3.0.0 up to (but not including) 3.1.1. Users are advised to upgrade to version 3.1.1 or later to address this security issue (OSS Security).