CVE-2025-54941

An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/29/6

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Un DAG de ejemplo 'example_dag_decorator' tenía un parámetro no validado que permitía al usuario de la interfaz de usuario (UI) redirigir el ejemplo a un servidor malicioso y ejecutar código en el worker. Esto, sin embargo, requería que los DAGs de ejemplo estuvieran habilitados en producción (no es el valor predeterminado) o que el código del DAG de ejemplo fuera copiado para construir su propio DAG similar. Si utilizó el 'example_dag_decorator', por favor revíselo y aplique los cambios implementados en Airflow 3.0.5 en consecuencia.

Information

Published : 2025-10-30 10:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-54941

Mitre link : CVE-2025-54941

CVE.ORG link : CVE-2025-54941

JSON object : View

Products Affected

apache

airflow

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-54941", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54941", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T03:55:26.812707Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "< 3.0.5", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2025-10-30T10:15:35.530", "references": [{"url": "https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/29/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly."}, {"lang": "es", "value": "Un DAG de ejemplo 'example_dag_decorator' ten\u00eda un par\u00e1metro no validado que permit\u00eda al usuario de la interfaz de usuario (UI) redirigir el ejemplo a un servidor malicioso y ejecutar c\u00f3digo en el worker. Esto, sin embargo, requer\u00eda que los DAGs de ejemplo estuvieran habilitados en producci\u00f3n (no es el valor predeterminado) o que el c\u00f3digo del DAG de ejemplo fuera copiado para construir su propio DAG similar. Si utiliz\u00f3 el 'example_dag_decorator', por favor rev\u00edselo y aplique los cambios implementados en Airflow 3.0.5 en consecuencia."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2461B24-C975-4644-B9FF-27F61C54C1DE", "versionEndExcluding": "3.0.5", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}