EUVD-2026-23660
GHSA-6337-2587-f2jq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.
AnalysisAI
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate privileges from UI user to worker-level code execution. Affects all Airflow versions before 3.2.0. The vulnerability stems from documentation suggesting unsafe handling of dag_run.conf parameters, which organizations may have replicated in production DAGs. EPSS score of 0.03% indicates low observed exploitation probability, though the upstream fix (PR #64129) demonstrates vendor acknowledgment and remediation.
Technical ContextAI
Apache Airflow is a platform for programmatically authoring, scheduling, and monitoring workflows as directed acyclic graphs (DAGs). The BashOperator component executes bash commands as part of workflow tasks. The vulnerability (CWE-77: Improper Neutralization of Special Elements used in a Command) arose from documentation demonstrating unsafe templating of dag_run.conf user inputs directly into BashOperator commands without sanitization. When dag_run.conf parameters - which authenticated UI users can control through the Airflow interface - are passed to bash execution contexts, attackers can inject shell metacharacters to execute arbitrary commands with the privileges of the Airflow worker process. This represents a privilege escalation from UI-level authenticated access to worker-level code execution, potentially compromising the entire workflow orchestration environment.
RemediationAI
Upgrade to Apache Airflow 3.2.0 or later, which includes corrected documentation and secure BashOperator examples per GitHub PR #64129 (https://github.com/apache/airflow/pull/64129). Review official security advisory at https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8 for vendor guidance. CRITICAL INTERIM STEP: Audit all custom DAG implementations for unsafe dag_run.conf parameter handling in BashOperator commands. Search DAG code for patterns like BashOperator(bash_command=f'command {dag_run.conf}') or similar templating that concatenates user-controlled conf values into shell commands without validation. Compensating controls prior to upgrade: implement input validation/sanitization for all dag_run.conf parameters before use in BashOperator contexts using allowlists for permitted characters (reject shell metacharacters: semicolons, pipes, backticks, dollar signs, ampersands); alternatively, refactor vulnerable DAGs to use PythonOperator with subprocess.run() and shell=False, which prevents shell injection by avoiding shell interpretation entirely (trade-off: requires code refactoring versus quick validation fixes). Restrict DAG authoring permissions to prevent introduction of new vulnerable patterns during remediation period (trade-off: may impact development velocity). These mitigations reduce attack surface but code review and upgrading remain definitive solutions.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today