CVE-2025-69219 describes an unsafe pickle deserialization vulnerability in Apache Airflow Providers Http, specifically within the HttpOperator. This flaw allows an authenticated user with direct database access to craft a malicious database entry, leading to remote code execution on the Triggerer component. While direct database access to Airflow is uncommon, successful exploitation grants the attacker the same permissions as a Dag Author. The vulnerability has a low FAUCET Risk Score of 27/100, and no CVSS score is provided. The attack requires prior database access, limiting its complexity and potential impact in typical Airflow deployments. Users are advised to upgrade to version 6.0.0 of the provider to mitigate this risk. There is no evidence of active exploitation, and no exploit intelligence (Metasploit, Nuclei, ExploitDB) is available. However, the CVE has garnered some community discussion with 4 mentions, including social media posts highlighting it as a high-severity (8.8) issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.1.0, < 6.0.0CPE matchmatch criteria | cpe:2.3:a:apache:airflow_providers_http:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator
Mar 9, 2026CVE-2025-69219: Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator
Mar 8, 2026