Apache Airflow Providers Edge3 versions prior to 2.0.0, when installed and configured on Airflow 2, expose a non-public internal API that allows remote code execution (RCE) in the webserver context. This vulnerability arises because the Edge3 provider for Airflow 2 included a development-only API that was not intended for production use. The issue does not affect Edge3 provider versions 2.0.0 and later, which require Airflow 3 and have removed the vulnerable code. Users running Edge3 on Airflow 3 are not affected.