Apache Airflow SSH Provider CVE-2026-111422

Not remotely exploitable against default configurations. Exploitation requires ALL of: (1) a Dag that uses SSHRemoteJobOperator and sets its templated environment parameter; (2) that Dag wiring trigger-time, user-controlled input (params or dag_run.conf) into one of those environment values; and (3) an attacker holding Airflow authorization to trigger that specific Dag. Key limiting factors: the attacker need NOT be able to author Dags (a lower-privileged trigger role suffices, which is the core of the issue), but the vulnerable Dag design above is non-default and must already exist; the injected command runs only with the privileges of the SSH connection's user on the remote host; and only apache-airflow-providers-ssh versions 4.3.0 through <7.0.1 are affected.

No CVSS score or vector is provided in the input (NVD/vendor show N/A), so severity signals must be weighed qualitatively. The technical impact is serious - arbitrary OS command execution (CWE-78) on the remote SSH host as the connection's user - but every other signal points to a contained, lower-urgency issue. EPSS is 0.27% (20th percentile), there is no CISA KEV listing (not actively exploited), no public exploit identified, and the vuln.today Decision label is 'monitor' rather than act_now/emergency. Exploitation is gated behind three conditions that are not default: a Dag must use SSHRemoteJobOperator's templated environment parameter, that Dag must route trigger-time input (params/dag_run.conf) into those values, and the attacker must already hold Airflow permission to trigger that specific Dag. This is therefore a real but moderate priority: high worst-case impact offset by non-default prerequisites, an authenticated trigger role, low exploitation probability, and an available patch. It is a patch-on-normal-cycle item, not a drop-everything emergency, consistent with the 'monitor' decision label.

An Airflow user who can trigger a specific Dag - but is not permitted to author Dags - triggers it while supplying a crafted value such as x$(id > /tmp/pwn) through params or dag_run.conf, which the Dag passes into SSHRemoteJobOperator's environment. Because each value was single-quoted only once yet spliced into an already single-quoted wrapper script, the $(...) is expanded and executed on the remote SSH host as the connection's user. No public exploit code is identified at time of analysis; the fix PR (#74810) does include regression tests demonstrating that command substitution, backticks, and semicolons in values are neutralized after the fix.