CVE-2025-69219

CVE-2025-69219: Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator

Vendor Apache Software Foundation
Product Apache Airflow Providers Http
Weakness CWE-913
Published March 9, 2026
Last update March 10, 2026

CVSS base score

What the vulnerability does

Description

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

Key dates

Disclosure timeline

March 9, 2026 CVE published
March 10, 2026 Record updated