Airflow Teradata Provider EUVD-2026-88697

Exploitation requires that the deployment actually runs the Apache Airflow Teradata provider's compute-cluster example DAG, or a DAG copied from it - the provider's shipped operator code is NOT vulnerable, so default installs that never deployed this example are unaffected. The attacker must be an Airflow user granted permission to TRIGGER that specific DAG (a lower-trust role than the DAG author) but needs no Teradata credentials of their own. Limiting factors: the example DAG must be present and unmodified (non-default for most deployments), and note that upgrading to 3.7.0 does NOT retroactively fix an already-copied DAG - operators who copied the example must manually apply the same Param constraints.

No CVSS vector, EPSS, KEV entry, or public POC is provided in any source, so quantitative exploitation signals are absent; the only severity signal is the vendor/reporter 'low' rating. The real-world risk is narrow but non-trivial where it applies: the flaw is a genuine SQL injection allowing arbitrary SQL/DDL execution and connection redirection, but it is gated behind a very specific precondition - the deployment must actually run the Teradata provider's compute-cluster EXAMPLE DAG (or a copy of it). Example DAGs are typically demonstration material, not production workloads, which sharply limits exposure. There is a tension worth flagging: the impact (arbitrary SQL under an existing Teradata connection, plus the ability to hijack any other connection in the deployment) is technically serious, yet the vendor rates it 'low' because the affected code is only example material and the trigger role must already be an authenticated Airflow user. Treat this as a low-urgency, config/hygiene issue for the general population, but as a real privilege-boundary bug (lower-trust DAG-trigger role escalating to arbitrary SQL) for any shop that deployed the example unmodified. No independent CVSS vector was published, so severity cannot be corroborated beyond the reporter's judgment.

An Airflow user who holds only the permission to trigger the Teradata compute-cluster example DAG - a lower-trust role that needs no Teradata credentials of its own - supplies malicious values in the free-text DAG Params at trigger time. Those params are templated directly into Teradata DDL, so the attacker's SQL fragments execute under the task's connection, and by setting the free-text connection-id param they can redirect the task at any other connection defined in the deployment. No public exploit code is identified, but the technique is straightforward for anyone with trigger access.