Airflow stores a port field on connections, but nowhere does it enforce that the value is a valid port number. A user can create a connection with port = -1, port = 99999999, or any other integer that is not a valid TCP/UDP port (0–65535), and Airflow will accept and persist it without complaint.
This is accepted through every entry point: the CLI, the public REST API, the execution API, and direct model construction. The value flows through to workers and is handed to provider hooks, which may silently misbehave or produce confusing errors far from the source of the bad data.
The connection port field should reject values outside the valid range at every layer where connections are accepted or created.
Affected areas:
- Core connection model (
airflow.models.connection)
- Task SDK connection definition (
airflow.sdk.definitions.connection)
- Public REST API connection request schema
- Execution API connection schema
- CLI connection create/update command
- JSON schema used for execution-time communication
Why fix this:
Port numbers have a well-defined valid range by the TCP/IP specification (0–65535). Accepting values outside this range produces connections that can never work, with no feedback to the user at the point of creation. Validation should be enforced at the boundary, not discovered at runtime inside a hook or provider.
Airflow stores a
portfield on connections, but nowhere does it enforce that the value is a valid port number. A user can create a connection withport = -1,port = 99999999, or any other integer that is not a valid TCP/UDP port (0–65535), and Airflow will accept and persist it without complaint.This is accepted through every entry point: the CLI, the public REST API, the execution API, and direct model construction. The value flows through to workers and is handed to provider hooks, which may silently misbehave or produce confusing errors far from the source of the bad data.
The connection port field should reject values outside the valid range at every layer where connections are accepted or created.
Affected areas:
airflow.models.connection)airflow.sdk.definitions.connection)Why fix this:
Port numbers have a well-defined valid range by the TCP/IP specification (0–65535). Accepting values outside this range produces connections that can never work, with no feedback to the user at the point of creation. Validation should be enforced at the boundary, not discovered at runtime inside a hook or provider.