What is CVE-2025-54941?

CVE-2025-54941 is a medium-severity vulnerability in Apache Airflow, classified under OS Command Injection. CVSS score: 4.6/10. Published 2025-10-30.

How severe is CVE-2025-54941?

Medium severity. CVSS v3 base score is 4.6 out of 10.

RCE in Apache Airflow

CVE-2025-54941

An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.005 (37.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N.

Affected products

Apache Airflow
Apache Software Foundation Airflow — versions 3.0.0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-54941?: CVE-2025-54941 is a medium-severity vulnerability in Apache Airflow, classified under OS Command Injection. CVSS score: 4.6/10. Published 2025-10-30.
How severe is CVE-2025-54941?: Medium severity. CVSS v3 base score is 4.6 out of 10.