Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Fix availableCritical · CVSS 9.8EPSS 11.1%

Published Jan 21, 2023 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: apache-airflow 2.5.1, apache-airflow-providers-mysql 4.0.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIapache-airflow1,549,965 downloads/week

Vulnerable versions
< 2.5.1
Fixed in
2.5.1

Check your project: pip show apache-airflow

PyPIapache-airflow-providers-mysql1,595,693 downloads/week

Vulnerable versions
< 4.0.0
Fixed in
4.0.0

Check your project: pip show apache-airflow-providers-mysql

Sources

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

← All critical vulnerabilities