What is the CVSS score of CVE-2026-42252?

CVE-2026-42252 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Airflow are affected by CVE-2026-42252?

Apache Airflow versions 3.0.0 through 3.2.1 contain a critical server-side template injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands on…. A patch is available.

How to fix or mitigate CVE-2026-42252?

24 hours: Inventory all Apache Airflow deployments running versions 3.0.0-3.2.1 and assess user access; restrict permissions for dag_run.conf parameter modification if unable to patch immediately. 7 days: Apply vendor patch per Apache Airflow advisory to upgrade affected systems to a patched version. 30 days: Audit historical access logs for suspicious dag_run.conf submissions; verify remediation across all Airflow instances and worker processes.

Apache Airflow CVE-2026-42252

EUVD-2026-33591 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-05-31

GHSA-c85c-g9wv-pph2

Apache Information Disclosure Ssti Airflow

9.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 17:24 vuln.today

Analysis Generated

Jun 02, 2026 - 17:24 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

9.1 (CRITICAL)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

May 31, 2026 - 12:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 31, 2026 - 12:45 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on apache-airflow (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.

Technical ContextAI

Apache Airflow is a workflow orchestration platform where DAGs (directed acyclic graphs) define pipelines composed of operators such as BashOperator. The BashOperator passes its bash_command field through Jinja2 template rendering before shell execution, and when authors directly interpolate dag_run.conf values (e.g. {{ dag_run.conf['conf1'] }}) into the command string, those values are first rendered as Jinja2 templates rather than treated as literal data. This maps to CWE-1336 (improper neutralization of special elements used in a template engine), the classic SSTI pattern. The upstream fix in PR #64129 demonstrates the safe pattern: pass user-controlled conf values through the env parameter and reference them as shell variables ($message), which avoids re-rendering the data through Jinja2 entirely.

RemediationAI

Upgrade to Apache Airflow 3.2.2 or later, which is the first release outside the affected range per the EUVD record; patch is available from the vendor and the upstream fix is tracked in https://github.com/apache/airflow/pull/64129. As an immediate code-level mitigation, rewrite vulnerable DAGs to pass dag_run.conf values via the BashOperator env parameter and reference them as shell variables in bash_command (e.g. echo "$message" with env={"message": '{{ dag_run.conf["message"] if dag_run else "" }}'}) rather than splicing them directly into the command template - this prevents Jinja2 from re-rendering attacker-controlled data. Where upgrade is not yet possible, restrict the can_create DAG run / can_edit permissions to trusted users only and audit existing DAGs for direct {{ dag_run.conf[...] }} interpolation inside BashOperator, PythonOperator command strings, or similar templated execution sinks; note that restricting trigger permissions reduces operational flexibility for self-service pipelines.