CVE-2025-62402

Fixed upstream EPSS <1%CVSS 5.4

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

Published 2025-10-30 · CVE record · OSV

Products: Apache Software Foundation Apache Airflow

Fixed upstream