Vulnerabilities

TI-2026-23727 CVE-2026-30898 · GHSA-6337-2587-f2jq

Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

MEDIUM 41

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00771 Published 2026-04-18 Fixed in 3.0.0, 3.2.0 CWE-77

TI-2026-23738 CVE-2026-30912 · GHSA-w7cf-2pmc-5m4c

Apache Airflow: Exposing stack trace in case of constraint error

LOW 39

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00449 Published 2026-04-18 Fixed in 3.0.0, 3.2.0 CWE-668

TI-2026-20948 CVE-2026-25917 · GHSA-6ffj-2wg2-w45j

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

LOW 35

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00822 Published 2026-04-18 Fixed in 3.0.0, 3.2.0 CWE-502

Vulnerabilities

Filters

Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

Apache Airflow: Exposing stack trace in case of constraint error

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)