CVE-2025-67895

Name of the Vulnerable Software and Affected Versions Apache Airflow Providers Edge3 versions prior to 2.0.0

Description The Edge3 provider for Apache Airflow 2 contains an issue that allows a Dag author to perform Remote Code Execution (RCE) in the webserver context through a non-public API. This API was intended for testing the Edge Provider during development and was implicitly enabled when the Edge3 provider was installed and configured on Airflow 2. The Edge3 provider support in Airflow 2 was development-only and not officially released. The issue is present only if the Edge3 provider was installed and configured on Airflow 2.

Recommendations If you installed and configured the Edge3 provider for Airflow 2, uninstall it and migrate to Airflow 3. If you used the Edge Provider in Airflow 3, you are not affected.