What is the CVSS score of CVE-2026-42252?

CVE-2026-42252 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Airflow are affected by CVE-2026-42252?

Apache Airflow versions 3.0.0 through 3.2.1 contain a critical server-side template injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands on…. A patch is available.

How to fix or mitigate CVE-2026-42252?

24 hours: Inventory all Apache Airflow deployments running versions 3.0.0-3.2.1 and assess user access; restrict permissions for dag_run.conf parameter modification if unable to patch immediately. 7 days: Apply vendor patch per Apache Airflow advisory to upgrade affected systems to a patched version. 30 days: Audit historical access logs for suspicious dag_run.conf submissions; verify remediation across all Airflow instances and worker processes.

Apache Airflow CVE-2026-42252

EUVD-2026-33591 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-05-31

GHSA-c85c-g9wv-pph2

Ssti Apache Information Disclosure Airflow

9.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 17:24 vuln.today

Analysis Generated

Jun 02, 2026 - 17:24 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

9.1 (CRITICAL)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

May 31, 2026 - 12:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 31, 2026 - 12:45 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on apache-airflow (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.

Technical ContextAI

Apache Airflow is a workflow orchestration platform where DAGs (directed acyclic graphs) define pipelines composed of operators such as BashOperator. The BashOperator passes its bash_command field through Jinja2 template rendering before shell execution, and when authors directly interpolate dag_run.conf values (e.g. {{ dag_run.conf['conf1'] }}) into the command string, those values are first rendered as Jinja2 templates rather than treated as literal data. This maps to CWE-1336 (improper neutralization of special elements used in a template engine), the classic SSTI pattern. The upstream fix in PR #64129 demonstrates the safe pattern: pass user-controlled conf values through the env parameter and reference them as shell variables ($message), which avoids re-rendering the data through Jinja2 entirely.

RemediationAI

Upgrade to Apache Airflow 3.2.2 or later, which is the first release outside the affected range per the EUVD record; patch is available from the vendor and the upstream fix is tracked in https://github.com/apache/airflow/pull/64129. As an immediate code-level mitigation, rewrite vulnerable DAGs to pass dag_run.conf values via the BashOperator env parameter and reference them as shell variables in bash_command (e.g. echo "$message" with env={"message": '{{ dag_run.conf["message"] if dag_run else "" }}'}) rather than splicing them directly into the command template - this prevents Jinja2 from re-rendering attacker-controlled data. Where upgrade is not yet possible, restrict the can_create DAG run / can_edit permissions to trusted users only and audit existing DAGs for direct {{ dag_run.conf[...] }} interpolation inside BashOperator, PythonOperator command strings, or similar templated execution sinks; note that restricting trigger permissions reduces operational flexibility for self-service pipelines.