CVE-2026-30898

UNKNOWN 0.0

Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.

CWE	CWE-77
Vendor	apache software foundation
Product	apache airflow
Published	Apr 18, 2026
Last Updated	Apr 18, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow

0 < 3.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/64129 lists.apache.org: https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8 openwall.com: http://www.openwall.com/lists/oss-security/2026/04/17/7

Credits

Peyton Kennedy (p80n-sec) from Endor Labs Kevin Yang