CVE-2025-54550

{"id": "CVE-2025-54550", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54550", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T11:56:37.252031Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.0", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-04-15T04:17:32.670", "references": [{"url": "https://github.com/apache/airflow/pull/63200", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/15/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The example example_xcom\u00a0that was included in airflow documentation implemented unsafe pattern of reading value\nfrom xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary\nexecution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.\n\nIt does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however\nusers following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of\nthe example with improved resiliance for that case.\n\nUsers who followed that pattern are advised to adjust their implementations accordingly."}, {"lang": "es", "value": "El ejemplo example_xcom que se incluy\u00f3 en la documentaci\u00f3n de Airflow implement\u00f3 un patr\u00f3n inseguro de lectura de valores de xcom de una manera que podr\u00eda ser explotada para permitir que un usuario de la interfaz de usuario (UI) que tuviera acceso para modificar XComs realizara la ejecuci\u00f3n arbitraria de c\u00f3digo en el worker. Dado que los usuarios de la interfaz de usuario (UI) ya son de alta confianza, esta es una vulnerabilidad de baja severidad.\n\nNo afecta a la versi\u00f3n de Airflow; los example_dags no deben habilitarse en un entorno de producci\u00f3n; sin embargo, los usuarios que siguieron el ejemplo podr\u00edan replicar el patr\u00f3n incorrecto. La documentaci\u00f3n de Airflow 3.2.0 contiene una versi\u00f3n del ejemplo con resiliencia mejorada para ese caso.\n\nSe aconseja a los usuarios que siguieron ese patr\u00f3n que ajusten sus implementaciones en consecuencia."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98A505A1-464C-4895-A628-9D8BEA1458E4", "versionEndExcluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}