What’s Vulnerable › Vulnerabilities

CVE-2025-69219: Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-09 · updated 2026-06-17
• Weakness: CWE-913

Description

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

Affected products

• Apache Software Foundation Apache Airflow Providers Http: from 5.1.0 before 6.0.0 — fixed in 6.0.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Airflow Providers Http 6.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/apache/airflow/pull/61662
• https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0
• http://www.openwall.com/lists/oss-security/2026/03/09/1

Get alerted when CVE-2025-69219 or the next vulnerability affects your stack