PyPI/apache-airflow-providers-edge3 CVE-2025-67895: critical 9.8, EPSS 1.00%

Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context

Action: Upgrade apache-airflow-providers-edge3 to 2.0.0 or later.

pip install apache-airflow-providers-edge3==2.0.0

Affected

Fixed versions

Sources

• osv: GHSA-66h8-3g48-6hx8
• https://nvd.nist.gov/vuln/detail/CVE-2025-67895
• https://github.com/apache/airflow/pull/59143
• https://github.com/apache/airflow
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2025-87.yaml
• https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs
• http://www.openwall.com/lists/oss-security/2025/12/16/3

CVE-2025-67895 · published 2025-12-17T12:30:12Z · modified 2026-06-29T12:26:17.096888224Z · JSON