Airflow SSH provider: command injection through templated environment values in SSHRemoteJobOperator

Impact

SSHRemoteJobOperator quotes the values of its templated environment parameter once, but then places them inside an already-quoted wrapper script, so shell syntax such as command substitution in a value is executed on the remote host. Any Dag that feeds trigger-time input - params or dag_run.conf - into environment turns the right to trigger that Dag into arbitrary command execution as the SSH connection's user. On a GPU fleet where Airflow drives training and data jobs over SSH into cluster login or submit nodes, that converts a low-privilege Airflow user who cannot author Dags into code execution on shared infrastructure, with whatever credentials and filesystem access the service account carries.

Who can reach it

An authenticated Airflow user who can trigger a Dag that passes trigger-time input into the operator's environment parameter. Dag-authoring rights are not needed; network reach to the Airflow UI or API is.

What to do

Upgrade apache-airflow-providers-ssh to 7.0.1 or later and restart the scheduler and workers that load the provider. No node drain or reboot is involved. Until then, audit Dags that pass params or dag_run.conf into the SSH operator's environment and restrict who can trigger them.

References

Related entries

• Atlantis: shell metacharacters in a pull request workspace name run commands as the Atlantis service accountCVE-2026-116676 · Atlantis (Terraform PR automation server, workspace name handling)High
• Jenkins: XStream deserialization filter not applied to resolves-to classesCVE-2026-117612 · Jenkins controller (XStream deserialization filter, resolves-to attribute)High
• Jenkins: unvalidated agent name lets a read-only user load and overwrite arbitrary config.xml on the controllerCVE-2026-117616 · Jenkins controller (agent-by-name HTTP endpoint)High
• Jenkins: low-privilege user can seed Manage Old Data warnings that overwrite user accounts including passwordsCVE-2026-117620 · Jenkins controller ("Manage Old Data" migration feature)High
• Jenkins: root element check bypass allows nesting types meant to live only in top-level config filesCVE-2026-117624 · Jenkins controller (XStream root element check for top-level configuration types)High
• MinIO: unsigned x-amz-* headers accepted in SigV4, escalating a presigned PUT into a cross-bucket readCVE-2026-122267 · MinIO (S3 Signature V4 verification)High