CVE-2025-69219
High
Description
A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Apache Airflow Providers Http
PublishedMar 9, 2026
First seenMar 9, 2026
Weakness typeCWE-913CWE-913
How to fix
Update
- apache airflow_providers_http6.0.0 or later
- apache-airflow-providers-http6.0.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache airflow_providers_http | 5.1.0 ≤ v < 6.0.0 | 6.0.0 |
| apache-airflow-providers-httpPyPI | v < 6.0.0 | 6.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.