Shell Command Injection Vulnerability in Apache Airflow's Example Dag

CVE-2026-101031

What is CVE-2026-101031?

A vulnerability exists in the example Dag provided with Apache Airflow, where an IP address fetched over HTTP is inadequately validated. Using Python's ipaddress module, the example Dag allows for the inclusion of arbitrary characters through IPv6 zone identifiers. If the load_examples option is enabled, a user can leverage this flaw by executing a custom url parameter that points to a malicious server. This could enable an attacker to inject shell commands executed on the worker node, compromising the system. It is crucial for users to update to Apache Airflow 3.4.0 or later, or to disable example Dags in production environments to mitigate this risk.

References