Is CVE-2025-67895 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67895 being exploited in the wild.

How severe is CVE-2025-67895?

Critical severity, with a CVSS score of 9.8, published 17 December 2025.

Which products and versions are affected?

apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.0; apache-airflow-providers-edge3 (PyPI) < 2.0.0, ECOSYSTEM:introduced=0,fixed=2.0.0.

Is there a fix for CVE-2025-67895?

Yes. apache-airflow (PyPI): upgrade to 2.0.0 or later; apache-airflow-providers-edge3 (PyPI): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-67895 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-67895?

Check whether you run Apache Software Foundation Airflow Providers Edge3, apache-airflow (PyPI) or apache-airflow-providers-edge3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67895: Apache Airflow Providers Edge3 RCE in web server context

Q: Is there a fix for CVE-2025-67895?

Yes. apache-airflow (PyPI): upgrade to 2.0.0 or later; apache-airflow-providers-edge3 (PyPI): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-67895 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-67895?

Check whether you run Apache Software Foundation Airflow Providers Edge3, apache-airflow (PyPI) or apache-airflow-providers-edge3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67895 · Severity: critical · CVSS 9.8 · Published 2025-12-17

Apache Airflow is an open-source platform used to schedule and monitor complex workflows. A vulnerability in the Edge3 provider component allows users who can author workflows (DAGs) to execute unauthorized commands on the central web server. This could lead to a full system compromise, unauthorized data access, or disruption of business operations.

Technologies: apache-airflow (PyPI). Vendors: Apache Software Foundation, PyPI.

Quick answers

Is CVE-2025-67895 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67895 being exploited in the wild.
How severe is CVE-2025-67895?: Critical severity, with a CVSS score of 9.8, published 17 December 2025.
Which products and versions are affected?: apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.0; apache-airflow-providers-edge3 (PyPI) < 2.0.0, ECOSYSTEM:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2025-67895?: Yes. apache-airflow (PyPI): upgrade to 2.0.0 or later; apache-airflow-providers-edge3 (PyPI): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67895 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-67895?: Check whether you run Apache Software Foundation Airflow Providers Edge3, apache-airflow (PyPI) or apache-airflow-providers-edge3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 2.0.0 or later
```
pip install "apache-airflow>=2.0.0"
```
apache-airflow-providers-edge3 (PyPI): upgrade to 2.0.0 or later
```
pip install "apache-airflow-providers-edge3>=2.0.0"
```

Technical details

A vulnerability exists in the Apache Airflow Providers Edge3 package (specifically versions prior to 2.0.0) when used with Airflow 2. The provider implicitly enables a non-public internal API, originally intended for development and testing of the Edge Provider. This API fails to properly restrict access, allowing a DAG author to perform Remote Code Execution (RCE) within the security context of the Airflow web server. The issue is classified as CWE-669 (Incorrect Resource Transfer Between Spheres). Users are advised to uninstall the affected provider from Airflow 2 environments and migrate to Airflow 3, as version 2.0.0 of the provider removes the vulnerable code and enforces a minimum requirement of Airflow 3.

Affected products

Apache Software Foundation apache-airflow-providers-edge3 < 2.0.0

Identifiers

CVE-2025-67895
GHSA-66h8-3g48-6hx8
PYSEC-2025-87
PYSEC-2026-276

Timeline

2025-12-07: patched: Pull request to drop Airflow 2 support merged
2025-12-17: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.