Apache Airflow Providers Http Unsafe Pickle Deserialization Leading to Remote Code Execution

A remote code execution vulnerability has been identified in the Apache Airflow Providers Http package, specifically in versions 5.1.0 prior to 6.0.0. This vulnerability arises from unsafe deserialization of pickle data, allowing a user with database access to craft an entry that executes code on the Triggerer. This execution grants the same permissions as the DAG Author. Although direct database access is uncommon and not recommended for Airflow, the vulnerability exists.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Apache Airflow is running.

Remediation

Users are advised to upgrade to version 6.0.0 of the Apache Airflow Providers Http package to mitigate this vulnerability.