PT-2026-33592 · Apache · Apache Airflow

Kevin Yang · Published 2026-04-18 · Updated 2026-04-21 · CVE-2026-30898

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow (affected versions not specified)

Description An example of BashOperator in the documentation suggested a method of passing dag run.conf that allows unsanitized user input to be used. This can lead to a privilege escalation where a UI user can execute code on the worker.

Recommendations Review all DAGs to ensure they have not adopted the incorrect documentation advice regarding the use of dag run.conf in BashOperator.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BIT-AIRFLOW-2026-30898

CVE-2026-30898

Affected Products

Apache Airflow

References · 7

• https://github.com/apache/airflow/pull/64129 · Patch
• https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30898 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2026-30898 · Vendor Advisory
• https://twitter.com/CVEnew/status/2045467316142436716 · Twitter Post
• https://twitter.com/oss_security/status/2045900686009811291 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/17/7 · Note