CVE-2025-67895

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed Dag author to perform Remote Code Execution in the webserver context, which Dag Author was not supposed to be able to do. If you installed and configured Edge3 provider for Airflow 2, you should uninstall it and migrate to Airflow 3. The new Edge3 provider versions (>=2.0.0) has minimum version of Airflow set to 3 and the RCE-prone Airflow 2 code is removed, so it should no longer be possible to use the Edge3 provider 2.0.0+ on Airflow 2. If you used Edge Provider in Airflow 3, you are not affected.

• CWE-669

• https://github.com/apache/airflow/pull/59143Issue Tracking, Patch
• https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqsMailing List
• http://www.openwall.com/lists/oss-security/2025/12/16/3Mailing List

Published

Dec 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67876ChurchCRM is an open-source church management system. A stor…5.4
• CVE-2025-67877ChurchCRM is an open-source church management system. Versio…8.8
• CVE-2025-6788A CWE-668: Exposure of Resource to Wrong Sphere vulnerabilit…5.3
• CVE-2025-67886Bitrix24 through 25.100.300 allows Remote Code Execution bec…6.3
• CVE-2025-678871C-Bitrix through 25.100.500 allows Remote Code Execution be…9.8
• CVE-2025-67888An issue was discovered in Control Web Panel (CWP) before 0.…7.3
• CVE-2025-67896Exim before 4.99.1, with certain non-default rate-limit conf…9.8
• CVE-2025-67897In Sequoia before 2.1.0, aes_key_unwrap panics if passed a c…5.3
• CVE-2025-67898MJML through 4.18.0 allows mj-include directory traversal to…4.5
• CVE-2025-67899uriparser through 0.9.9 allows unbounded recursion and stack…2.9
• CVE-2025-6790The Quiz and Survey Master (QSM) WordPress plugin before 10…4.3
• CVE-2025-67900NXLog Agent before 6.11 can load a file specified by the OPE…8.1