BIT-airflow-2026-30898

vendorUSosv

Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

view advisory published 2026-04-21Licence: per source

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-30898US	—	0.77% (55th)	—	2026-04-18
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/04/17/7ADVISORY
https://github.com/apache/airflow/pull/64129REPORT
https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-30898WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan