CVE-2025-62503 – Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

CVE ID : CVE-2025-62503

Published : Oct. 30, 2025, 10:15 a.m. | 1 hour, 10 minutes ago

Description : User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…