Apache Airflow CVE-2025-62503

Exploitation requires an authenticated Airflow account that has been explicitly granted the CREATE privilege for Pools, Connections, or Variables while lacking the UPDATE privilege, and the attacker must invoke the bulk create API endpoint using the 'overwrite' action against the name of an already-existing record. Limiting factors: a valid authenticated account with the specific CREATE permission is required, so this is only meaningful in deployments that use fine-grained RBAC to separate CREATE from UPDATE; it cannot be triggered by unauthenticated users and has no impact where users already hold UPDATE rights.

This is a moderate-severity authorization/privilege-escalation flaw (CVSS 4.6, CWE-250 Execution with Unnecessary Privileges) in Apache Airflow where a user holding only CREATE (but not UPDATE) privileges on Pools, Connections, or Variables can overwrite existing records through the bulk-create API's 'overwrite' action. The signals are internally consistent on low-to-moderate risk: the CVSS vector requires authentication (PR:L) and yields only partial confidentiality/integrity impact (C:L/I:L/A:N), EPSS is low at 0.43% (36th percentile), there is no CISA KEV listing, and no public exploit was identified - pointing to a real but non-urgent, insider/privilege-boundary issue rather than a mass-exploitation threat. One discrepancy must be flagged: the supplied CVSS vector includes UI:R (user interaction required), which is unusual for a programmatic REST API abuse and likely does not reflect how the bulk API is actually invoked - verify with the Apache advisory. The practical risk is elevated beyond the raw score for organizations using fine-grained RBAC where CREATE-only roles are intentionally granted to limit blast radius, because this bug collapses the CREATE/UPDATE distinction and could let a lower-trust user tamper with Connections (which may hold credentials/endpoints) or Variables that drive DAG behavior.

An authenticated Airflow user who was intentionally granted only CREATE (not UPDATE) permission on Connections submits a bulk-create API request with the 'overwrite' action targeting the name of an existing production Connection, silently replacing its configuration despite lacking UPDATE rights. By repointing a Connection or altering a Variable, the attacker can influence downstream DAG execution. No public exploit code was identified at time of analysis, and exploitation requires a valid account.