Read the docs
TI-2025-19889 Aliases CVE-2025-27018GHSA-hhm6-jjf4-6pm3

Apache Airflow MySQL Provider: SQL injection in MySQL provider core function

Priority LOW 30CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modification and others. This issue affects Apache Airflow MySQL Provider: before 6.2.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00911 60th percentileScored 2026-11-07
Fix Fixed Apache Airflow MySQL Provider (Apache Software Foundation): 6.2.0apache-airflow-providers-mysql (PyPI): 6.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow MySQL Providerbefore 6.2.06.2.0Patch availableCNA
—apache-airflow-providers-mysql (PyPI)before 6.2.06.2.0Patch availableGHSA-hhm6-jjf4-6pm3
  • Apache Airflow MySQL Provider VendorApache Affected before 6.2.0 Fixed in 6.2.0 Patch available CNA
  • apache-airflow-providers-mysql (PyPI) Vendor— Affected before 6.2.0 Fixed in 6.2.0 Patch available GHSA-hhm6-jjf4-6pm3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-mysql:*:*:*:*:*:*:*:*before 6.2.0VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-mysql:*:*:*:*:*:*:*:* Versions before 6.2.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow MySQL Provider (Apache Software Foundation) Fixed in 6.2.0
  • Fix · GHSA-hhm6-jjf4-6pm3 apache-airflow-providers-mysql (PyPI) Fixed in 6.2.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27018
  2. 2026-10-03 Alias added: GHSA-hhm6-jjf4-6pm3

References

Patch 2

Advisory 2

Other 2

  • TI-2023-09028 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences