Apache Airflow: DAG authors can execute code in the scheduler through the doc_md parameter

Impact

A DAG author - a role the Airflow security model treats as less privileged than a deployment admin - can place a crafted doc_md value in a DAG file and have it evaluated as code inside the scheduler process. On a shared training or data-prep cluster, the scheduler usually runs with the broadest credentials in the deployment: connection secrets, the metadata database, cloud and registry credentials used to launch GPU jobs. Code execution there is a pivot from "can submit a pipeline" to "owns the orchestration layer", including the ability to redirect other tenants' jobs. Affects 2.4.0 through versions before 2.9.3.

Who can reach it

Authenticated user with DAG-author privileges (ability to add or modify a DAG file the scheduler parses). No admin rights needed; not reachable by an unauthenticated network caller.

What to do

Upgrade apache-airflow to 2.9.3 or later and restart the scheduler, webserver and workers. No node reboot or firmware work; the cost is an orchestration-layer restart window, during which queued GPU jobs are not scheduled. Until then, treat DAG-file write access as equivalent to scheduler code execution and restrict who holds it.

References

Related entries

• Jenkins: Agent processes can read arbitrary controller files via ClassLoaderProxy#fetchJarCVE-2024-43044 · JenkinsHigh
• Digi ConnectPort LTS (before 1.4.12): An attacker who can reach the ConnectPort LTS's file-upload featureCVE-2024-50627 · Digi ConnectPort LTS (before 1.4.12)High
• Deep Sea Electronics DSE855 generator communications gateway: Six unauthenticated flaws in one device: two stack-basedCVE-2024-5948 · Deep Sea Electronics DSE855 generator communications gatewayHigh
• PostgreSQL: TOCTOU race in pg_dumpCVE-2024-7348 · PostgreSQLHigh
• Automated Logic / Carrier i-Vu Gen5 BACnet router (drv_gen5_106-01-2380) and i-Vu Zone Controller: Malformed BACnetCVE-2025-0657 · Automated Logic / Carrier i-Vu Gen5 BACnet router (drv_gen5_106-01-2380) and i-Vu Zone ControllerHigh
• GitLab EE: authenticated user with certain permissions can hijack another project's CI runnersCVE-2025-11702 · GitLab EE (project CI runner assignment)High