Apache Airflow: docs example templated dag_run.conf into BashOperator unquoted, inviting shell injection in copied DAGs

Impact

Airflow's dag-run documentation showed a BashOperator example that interpolated dag_run.conf straight into a shell command with no quoting or warning. DAGs written from that pattern let any user holding Dag.can_trigger inject shell metacharacters through the trigger API's conf field and reach command execution on the Airflow worker - the typical case being a multi-team deployment or a hosted trigger endpoint. On a GPU fleet the worker is usually the thing that holds registry credentials, object-store keys and cluster access used to launch training jobs, so this is a jump from a scheduling permission to arbitrary code in the job-submission path. Note what this CVE actually covers: the flaw lives in DAG code copied from the docs, not in Airflow itself, and the fix is the corrected documentation in apache/airflow PR 64129. Affected deployments are those whose DAGs were modelled on the pre-correction example; same class as CVE-2025-50213 and CVE-2025-27018.

Who can reach it

An authenticated Airflow user with Dag.can_trigger on an affected DAG, via the trigger API or UI. Exposure depends entirely on whether your own DAG code uses the unquoted pattern.

What to do

Audit your DAGs for BashOperator commands that template dag_run.conf, params or other user-supplied Jinja values into a shell string, and quote them or move to a non-shell operator. Upgrade to apache-airflow 3.2.2 or later to pick up the corrected documentation - the upgrade alone does not fix DAG code you already wrote. Also review who holds Dag.can_trigger. This is a scheduler and worker restart plus a code change in your own repo, not a node-level maintenance window.

References

Related entries

• Ceph Monitor: any read-only CephX user can dump the config-key store, including cephadm's cluster-wide SSH keyCVE-2026-50152 · Ceph Monitor (MMonSubscribe config-key store authorization)Critical
• Airflow SFTP provider: malicious remote server writes files outside the local destination directoryCVE-2026-50203 · Apache Airflow SFTP provider (SFTPHook.retrieve_directory / SFTPOperator operation=get)Critical
• NVIDIA AIStore: token-revocation endpoint accepts unauthenticated revocation listsCVE-2026-65173 · NVIDIA AIStore (token-revocation endpoint)Critical
• Apache Airflow FAB provider: Azure AD id_token issuer and audience unchecked, any tenant can log inCVE-2026-75156 · Apache Airflow FAB provider (Azure AD OAuth id_token issuer/audience validation)Critical
• Airflow Keycloak provider: Keycloak tokens from unsigned cookies are not bound to the session identityCVE-2026-76186 · Apache Airflow Keycloak provider (session identity vs. Keycloak access/refresh token binding)Critical
• Fortra BoKS Manager: command injection in crlserver gives root on the BoKS Master via a crafted CRL URLCVE-2026-79898 · Fortra BoKS Manager crlserver (CRL URL handling)Critical