Remote Code Execution Vulnerability in Apache Airflow SSH Provider

CVE-2026-111422

What is CVE-2026-111422?

In versions of the Apache Airflow SSH Provider prior to 7.0.1, a vulnerability exists due to improper handling of the templated environment parameter in the SSHRemoteJobOperator. This flaw allows an attacker with permission to trigger a DAG to execute arbitrary shell commands on the remote SSH host, leveraging trigger-time inputs passed into the environment. Users are strongly encouraged to upgrade to version 7.0.1 or later to mitigate this issue effectively.

References