PT-2026-33592 · Apache · Apache Airflow

Kevin Yang · Published 2026-04-18 · Updated 2026-04-18 · CVE-2026-30898

NVD

An example of BashOperator in Airflow documentation suggested a way of passing dag run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-30898

Affected Products

Apache Airflow

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30898 · Security Note
• https://github.com/apache/airflow/pull/64129 · Patch
• https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/04/17/7 · Note