CVE-2025-27018 - SQL Injection Vulnerability in Apache Airflow MySQL Provider

A critical SQL Injection vulnerability, tracked as CVE-2025-27018, was discovered in the Apache Airflow MySQL Provider package. The flaw exists in the way the MySQL Provider handled user-supplied input for table names in the dump_sql and load_sql functions. If a user triggers a DAG (Directed Acyclic Graph) from the Airflow UI, they could exploit this issue by passing crafted input—as the table parameter—to run unintended SQL commands.

This post explains the vulnerability, shows a hypothetical exploit, and offers mitigation advice. The issue affects Airflow MySQL Provider versions before 6.2.. Users should immediately upgrade to 6.2..

1. Background

Apache Airflow is an open-source platform for orchestrating complex computational workflows. Airflow uses providers to connect with various data systems, including MySQL.

The MySQL Provider’s dump_sql and load_sql functions support operations (exporting/importing data) based on user-given inputs—including table names. If these inputs are improperly handled, it can put data at risk.

CWE-89: Improper Neutralization of Special Elements used in an SQL Command

The root cause, as described in CVE-2025-27018 and the Apache security advisory, is that special SQL characters in user-supplied table parameters were not correctly sanitized or escaped. Attackers could submit malicious input via the Airflow UI, leading to SQL Injection.

Impacted: Apache Airflow MySQL Provider < 6.2.

- Resolved in: 6.2.

Suppose the code (simplified for demonstration) looks like this

def dump_sql(table, cursor):
    query = f"SELECT * FROM {table};"
    cursor.execute(query)
    # ...process export...

def load_sql(table, values, cursor):
    query = f"INSERT INTO {table} VALUES ({values});"
    cursor.execute(query)
    # ...process import...

If table comes from a form field in the Airflow web UI

# BAD: Directly inserting user input (table) into SQL string
trigger_dag(
    dag_id='export_table',
    conf={'table': request.form['table']}
)

An attacker goes to the Airflow UI and triggers a DAG, providing a malicious table name

users; DROP TABLE important_data; --

The dump_sql function would then execute

SELECT * FROM users; DROP TABLE important_data; --;

Result: This would export rows from users, then drop the important_data table!

Let’s say, from the web UI or using Airflow’s API, you trigger

{
  "table": "employees; DELETE FROM users WHERE id=1; --"
}

5.2. The SQL Run on the Database

SELECT * FROM employees; DELETE FROM users WHERE id=1; --;

A single user action could lead to data loss or corruption.

6. Impact

- Data Corruption: Modification or deletion of critical tables/data.
- Unauthorized Access/Escalation: Running unintended queries.

7. Fix and Mitigation

Fixed in version 6.2.. Changelog

Upgrade MySQL Provider:

  pip install --upgrade apache-airflow-providers-mysql

def dump_sql(table, cursor)

# Use whitelisting/validation

cursor.execute(query)

`

Or use framework helpers to validate table names.

---

## 8. References

- CVE-2025-27018 at NVD (National Vulnerability Database)
- Apache Airflow Security Advisory
- Airflow MySQL Provider 6.2. Release
- SQL Injection — OWASP Guide

---

## 9. Conclusion

CVE-2025-27018 is a high-risk SQL injection vulnerability in the Apache Airflow MySQL Provider, present until version 6.2.. If left unpatched, attackers can cause catastrophic data breaches simply by submitting crafted input via the Airflow UI.

Upgrade to Airflow MySQL Provider 6.2. or later as soon as possible.
Audit all code and workflows for similar issues to keep your Airflow environment safe.

---

*If you have questions about this issue or want to check if you are vulnerable, visit the official Apache advisory thread or contact your security team.*

Timeline

Published on: 03/19/2025 09:15:14 UTC
Last modified on: 03/25/2025 18:15:34 UTC