Threats affecting pkg:pypi/apache-airflow-providers-http

CVE-2025-69219 is a high-severity vulnerability in Apache Airflow Providers Http version 5.1.0 that allows a user with database access to execute arbitrary code on the Triggerer component. This flaw arises from improper control of dynamically-managed code resources (CWE-913), enabling an attacker with DB access to gain permissions equivalent to a DAG author. Although direct database access is uncommon and not recommended in Airflow deployments, exploitation could lead to full compromise of workflow execution privileges. The vulnerability has a CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability without requiring user interaction. Upgrading to version 6.0.0 of the provider is advised to mitigate this risk.