GHSA-9r5j-7r2x-rv4g

Source

https://github.com/advisories/GHSA-9r5j-7r2x-rv4g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9r5j-7r2x-rv4g/GHSA-9r5j-7r2x-rv4g.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-9r5j-7r2x-rv4g

Aliases

Downstream

CGA (6)

ECHO (1)

ECHO-7803-48c3-bfab

MINI (2)

Published

2026-03-09T12:31:38Z

Modified

2026-07-17T21:10:00Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator

Details

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low.

Users should upgrade to version 6.0.0 of the provider to avoid even that risk.

Database specific

{
    "cwe_ids":  [
        "CWE-913"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-10T01:21:24Z",
    "nvd_published_at":  "2026-03-09T11:16:05Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / apache-airflow-providers-http

Package

Name: apache-airflow-providers-http; View open source insights on deps.dev
Purl: pkg:pypi/apache-airflow-providers-http

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.0.0

Affected versions

1.*

1.0.0b1

1.0.0b2

1.0.0rc1

1.0.0

1.1.0rc1

1.1.0

1.1.1rc1

1.1.1

2.*

2.0.0rc1

2.0.0rc2

2.0.0

2.0.1rc1

2.0.1

2.0.2rc1

2.0.2

2.0.3rc1

2.0.3rc2

2.0.3

2.1.0rc1

2.1.0

2.1.1rc1

2.1.1

2.1.2rc1

2.1.2

3.*

3.0.0rc1

3.0.0rc2

3.0.0

4.*

4.0.0rc1

4.0.0

4.1.0rc1

4.1.0

4.1.1rc1

4.1.1

4.2.0rc1

4.2.0

4.3.0rc1

4.3.0

4.4.0rc1

4.4.0rc2

4.4.0

4.4.1rc1

4.4.1

4.4.2rc1

4.4.2

4.5.0rc1

4.5.0

4.5.1rc1

4.5.1

4.5.2rc1

4.5.2

4.6.0rc1

4.6.0

4.7.0rc1

4.7.0rc2

4.7.0

4.8.0rc1

4.8.0

4.9.0rc1

4.9.0rc2

4.9.0

4.9.1rc1

4.9.1

4.10.0rc1

4.10.0

4.10.1rc1

4.10.1

4.11.0rc1

4.11.0

4.11.1rc1

4.11.1

4.12.0rc1

4.12.0

4.13.0rc1

4.13.0

4.13.1rc1

4.13.1

4.13.2rc1

4.13.2

4.13.3rc1

4.13.3

5.*

5.0.0rc1

5.0.0rc2

5.0.0

5.1.0

5.2.0rc1

5.2.0

5.2.1rc1

5.2.1

5.2.2rc1

5.2.2

5.3.0rc1

5.3.0

5.3.1rc1

5.3.1

5.3.2rc1

5.3.2

5.3.3rc1

5.3.3

5.3.4rc1

5.3.4

5.4.0rc1

5.4.0

5.5.0rc1

5.5.0

5.6.0rc1

5.6.0

5.6.1rc1

5.6.1

5.6.2rc1

5.6.2

5.6.3rc1

5.6.3

5.6.4rc1

5.6.4

6.*

6.0.0rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9r5j-7r2x-rv4g/GHSA-9r5j-7r2x-rv4g.json"