Database/Control plane, storage & DevOps
Apache Airflow: documented BashOperator pattern lets a UI user inject commands onto the worker via dag_run.conf
Impact
An example in the Airflow documentation showed passing dag_run.conf into a BashOperator command in a way that puts unsanitised user input into the shell string. A DAG that followed that pattern lets anyone who can trigger it with a configuration escalate from UI user to command execution on the worker that runs the task. On a GPU fleet the Airflow worker is usually the host or pod with fleet credentials and data-path access, so this converts pipeline-trigger rights into execution where the jobs run. The flaw lives in operators' own DAGs rather than in Airflow's code, so upgrading Airflow does not remove it - only auditing the DAGs does.
Who can reach it
An authenticated Airflow UI user with permission to trigger a DAG run with configuration, where that DAG interpolates dag_run.conf into a BashOperator command.
What to do
Audit your own DAGs for BashOperator (or similar shell) commands that interpolate dag_run.conf or other run-time input directly, and pass such values through the environment or validated parameters instead. The upstream change is to the documentation, so redeploying the DAGs is the fix; there is no Airflow version that remediates an affected DAG.
References
Related entries
- Jenkins: symlinks in tar archives let a job or agent write files anywhere the controller canCVE-2026-33001 · Jenkins controller (.tar/.tar.gz extraction, symlink handling)High
- Apache Airflow: a crafted XCom payload makes the webserver execute code in its own contextCVE-2026-33858 · Apache Airflow webserver (XCom payload rendering)High
- Apache ActiveMQ: Improper input validation and code injection in the brokerCVE-2026-34197 · Apache ActiveMQHigh
- Supermicro SMASH service (X14DBG-DAP, X14DBI): An attacker with any authorised BMC login escalates through the SMASHCVE-2026-3821 · Supermicro SMASH service (X14DBG-DAP, X14DBI)High
- Ceph RGW: unauthenticated STS token encryption lets any token holder bit-flip themselves to RGW adminCVE-2026-39944 · Ceph RADOS Gateway (STS session token AES-128-CBC handler)High
- MinIO (S3 API, Snowball auto-extract): The Snowball auto-extract path skips signature verification entirely, so anCVE-2026-40344 · MinIO (S3 API, Snowball auto-extract)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.