Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modification and others. This issue affects Apache Airflow MySQL Provider: before 6.2.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
    Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could
    pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It
    could lead to data corruption, modification and others. This issue affects Apache Airflow MySQL Provider:
    before 6.2.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue. (CVE-2025-27018)

ID	Name	Product	Family	Type	Severity
471127	Echo: apache-airflow-providers-mysql: security update to 6.2.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
471127	Echo: apache-airflow-providers-mysql: security update to 6.2.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
421152	SCA: security update for apache-airflow-providers-mysql (GHSA-hhm6-jjf4-6pm3)	Tenable Cloud Security	SCA Checks	Local	medium
421152	SCA: security update for apache-airflow-providers-mysql (GHSA-hhm6-jjf4-6pm3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-27018

medium

Tenable Plugins

medium

medium

medium

medium