CVE-2025-62503 — Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

CVE-2025-62503

Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables) PUBLISHED

Description (CNA)

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Vendor / product	Versions
Apache Software Foundation / Apache Airflow	affected 3.0.0 before 3.1.1

CWE-250

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.