Cyber Posture

CVE-2025-69219

High

Published: 09 March 2026

Published
09 March 2026
Modified
10 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0001 3.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-69219 is a high-severity Improper Control of Dynamically-Managed Code Resources (CWE-913) vulnerability in Apache Airflow Providers Http. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Python (T1059.006); ranked at the 3.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Python (T1059.006) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the vulnerability by requiring timely remediation through upgrading to version 6.0.0 of the provider, eliminating the code execution flaw.

prevent

Prevents arbitrary code execution by enforcing validation of malicious database entries processed by the Triggerer component.

prevent

Enforces least privilege to restrict direct database access, which is required for crafting the malicious entry and not a recommended access pattern in Airflow.

MITRE ATT&CK Enterprise TechniquesAI

T1059.006 Python Execution
Adversaries may abuse Python commands and scripts for execution.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct arbitrary code execution on Triggerer via crafted DB entry enables Python interpreter abuse (T1059.006) and explicit escalation to Dag Author privileges (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is…

more

not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

Deeper analysisAI

CVE-2025-69219 is a code execution vulnerability (CWE-913) affecting Apache Airflow, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It allows a user with database access to craft a malicious database entry that triggers arbitrary code execution on the Triggerer component. This effectively grants the attacker the same permissions as a Dag Author. The vulnerability was published on 2026-03-09.

An attacker requires low privileges, specifically access to the Airflow database, which is not a typical or recommended access pattern. Successful exploitation leads to remote code execution on the Triggerer, enabling privilege escalation to Dag Author levels and potential high-impact compromise of confidentiality, integrity, and availability. Although direct database access is uncommon in Airflow deployments, the low attack complexity and network accessibility increase the risk for misconfigured environments.

Advisories recommend upgrading to version 6.0.0 of the affected provider to mitigate the issue entirely. Relevant resources include the Apache Airflow GitHub pull request at https://github.com/apache/airflow/pull/61662, the Apache mailing list thread at https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0, and the OSS-Security announcement at http://www.openwall.com/lists/oss-security/2026/03/09/1.

Details

CWE(s)

Affected Products

apache
airflow providers http
5.1.0 — 6.0.0

CVEs Like This One

CVE-2022-31764Same vendor: Apache
CVE-2025-23015Same vendor: Apache
CVE-2026-40048Same vendor: Apache
CVE-2026-24072Same vendor: Apache
CVE-2025-66524Same vendor: Apache
CVE-2026-27172Same vendor: Apache
CVE-2025-54550Same vendor: Apache
CVE-2026-41044Same vendor: Apache
CVE-2026-30898Same vendor: Apache
CVE-2026-27314Same vendor: Apache

References