VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML
JVNDB-2026-006866     ( CVE-2025-69219 | CVE-2025-69219 | CVE-2025-69219: Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator-Apache Mail Archives )
Apache Software FoundationのAirflow Providers Httpにおける動的に操作されるコードリソースの不適切な制御に関する脆弱性
https://jvndb.jvn.jp/ja/contents/2026/JVNDB-2026-006866.html

Original

DBにアクセスできるユーザーが、Triggerer上でコードを実行させるデータベースエントリを作成できる可能性があります。これにより、DBにアクセスできる誰もがDag Authorと同じ権限を持つことになります。Airflowでは直接DBアクセスは通常推奨されていないため、実際に被害が発生する可能性は低いです。リスクを回避するために、プロバイダーのバージョン6.0.0にアップグレードすることを推奨します。

Translation   (Show)





About This Analysis Information
Analysis Information Provider:
JVN iPedia
First Published:
2026-03-12
Source Information Category:
Advisory, Alert
Last Updated:
2026-03-12




Affected Product Tags
cpe:/a:apache:airflow_providers_http
 


Vulnerability Analysis Results
[Access Vector]  [?]
Undefined [?]

Local [?]
Adjacent Network [?]
Network [?]

[Access Complexit]  [?]
Undefined [?]

High [?]
Medium [?]
Low [?]

[Authentication]  [?]
Undefined [?]

Multiple [?]
Single [?]
None [?]

[Confidentiality Impact]  [?]
Undefined [?]

None [?]
Partial [?]
Complete [?]

[Integrity Impact]  [?]
Undefined [?]

None [?]
Partial [?]
Complete [?]

[Availability Impact]  [?]
Undefined [?]

None [?]
Partial [?]
Complete [?]

Alternatives
Common Vulnerabilities and Exposures (CVE) CVE-2025-69219




National Vulnerability Database (NVD) CVE-2025-69219




関連文書 CVE-2025-69219: Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator-Apache Mail Archives








References
JVNDB CWE-913 動的に操作されるコードリソースの不適切な制御




Openwall mailing list archives oss-security - CVE-2025-69219: Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator




関連文書 Replace pickle with json serialization for http triggers by amoghrajesh Pull Request #61662 apache/airflow GitHub





Copyright © 2026 JPCERT/CC All Rights Reserved.