CVE-2026-30898: Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-18 · updated 2026-10-26
Weakness: CWE-77

Description

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.

Affected products

Apache Airflow: before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: Apache Airflow 3.2.0. Check the vendor advisory for mitigations.

References

https://github.com/apache/airflow/pull/64129
https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8
http://www.openwall.com/lists/oss-security/2026/04/17/7

Get alerted when CVE-2026-30898 or the next vulnerability affects your stack