CVE-2025-62402: Apache Airflow `/api/v2/dagReports` executes DAG Python in API

October 30, 2025

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

References

github.com/advisories/GHSA-273c-4g26-4jpm
github.com/apache/airflow
github.com/apache/airflow/commit/828aaa0b1d95caf90612a648867c17aec7e87874
github.com/apache/airflow/pull/56609
lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs
nvd.nist.gov/vuln/detail/CVE-2025-62402

Code Behaviors & Features

Detect and mitigate CVE-2025-62402 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →