CVE-2025-67895: 
Python vulnerability analysis and mitigation

CVE-2025-67895 is a Remote Code Execution (RCE) vulnerability in Apache Airflow Providers Edge3, specifically affecting versions before 2.0.0 when installed and configured on Apache Airflow 2. The flaw stems from a development-only, non-public API that was inadvertently left enabled in the Edge3 provider for Airflow 2, allowing a DAG author to execute arbitrary code in the webserver context — a privilege they should not possess. The vulnerability was discovered by a researcher identified as "Lee" and publicly disclosed on December 17, 2025, with the fix merged on December 7, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical), as assessed by CISA-ADP (Github Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-669 (Incorrect Resource Transfer Between Spheres): the Edge3 provider for Airflow 2 implicitly exposed an internal Worker RPC API endpoint that was intended solely for development and testing purposes, never for production use (Github Advisory). This non-public API, when reachable, allowed a DAG author — a role with limited trust — to invoke RPC calls that resulted in arbitrary code execution within the Airflow webserver process context. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity, making it exploitable by any party with network access to the Airflow webserver if the Edge3 provider is installed on Airflow 2. The fix, implemented in pull request #59143, removes all Airflow 2 support code from the Edge3 provider and sets the minimum required Airflow version to 3 (Airflow PR #59143).

Successful exploitation allows a DAG author — or any attacker who can create or modify DAGs — to execute arbitrary code within the Airflow webserver's process context, leading to complete compromise of the webserver host. This can result in unauthorized access to sensitive data processed by Airflow pipelines, manipulation of workflow definitions, credential theft (e.g., Airflow connections and variables), and potential lateral movement to connected systems and data stores (Github Advisory, Feedly). The confidentiality, integrity, and availability impacts are all rated High.

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.30–0.35%, indicating a low but non-negligible probability of exploitation in the near term (Github Advisory). The practical attack surface is limited to organizations that specifically installed and configured the Edge3 provider on Airflow 2, which was never an officially supported or released configuration.

1. Identify target: Locate an Apache Airflow 2 deployment with the apache-airflow-providers-edge3 package (version < 2.0.0) installed and configured, which implicitly exposes the internal Edge3 Worker RPC API endpoint on the Airflow webserver.
2. Gain DAG author access: Obtain credentials or access for an Airflow account with DAG authoring privileges (e.g., through phishing, credential stuffing, or insider access).
3. Locate the exposed RPC API: Identify the non-public Edge3 Worker RPC API endpoint on the Airflow webserver — this endpoint was enabled automatically when the Edge3 provider was configured on Airflow 2.
4. Craft malicious RPC call: Construct an RPC request targeting the exposed API endpoint with a payload designed to execute arbitrary code in the webserver process context.
5. Achieve RCE: Submit the crafted request to the webserver; the API executes the payload without proper authorization checks, granting code execution as the webserver process user, enabling data exfiltration, credential theft, or further lateral movement (Openwall OSS-Sec, Github Advisory).

• Network: Unexpected HTTP requests to internal Edge3 Worker RPC API endpoints on the Airflow webserver from unauthorized or unusual source IPs; outbound connections from the Airflow webserver process to external hosts not associated with normal DAG execution.
• Logs: Airflow webserver access logs showing requests to Edge3 RPC API paths from DAG author accounts or unexpected clients; unusual error messages or stack traces in Airflow webserver logs related to RPC handler invocations.
• Process: Unexpected child processes spawned by the Airflow webserver process (e.g., shell interpreters, network utilities such as curl, wget, nc); processes running under the Airflow webserver service account performing actions outside normal workflow execution.
• File System: New or modified files in the Airflow installation directory, unexpected scripts or binaries written by the webserver process, or new cron jobs created under the Airflow service account.

The primary remediation is to uninstall the apache-airflow-providers-edge3 package from any Airflow 2 deployment immediately, as the Airflow 2 + Edge3 configuration was never officially supported and is the sole attack surface (Openwall OSS-Sec). Organizations wishing to continue using the Edge3 provider should migrate to Apache Airflow 3 and upgrade to apache-airflow-providers-edge3 version 2.0.0 or higher, which enforces a minimum Airflow version of 3 and removes all vulnerable Airflow 2 code (Github Advisory, Airflow PR #59143). As an additional hardening measure, restrict DAG creation and modification permissions to trusted users only, and implement strict network access controls around the Airflow webserver.

The Apache Software Foundation disclosed the vulnerability via the oss-security mailing list on December 15–17, 2025, with Jarek Potiuk (Apache Airflow maintainer) noting the severity as "low" in the original disclosure — a rating that contrasts with the CISA-ADP CVSS 9.8 Critical score, reflecting the limited real-world exposure due to the development-only nature of the affected configuration (Openwall OSS-Sec). The vulnerability received coverage from automated security feeds and community aggregators including VulDB, Vulners, and CIRCL, as well as brief mentions on Bluesky infosec accounts. No significant independent researcher commentary or major media coverage was identified beyond standard vulnerability database entries.