Privilege Escalation in Apache Airflow Due to Unsanitized User Input

CVE-2026-30898

What is CVE-2026-30898?

A vulnerability in Apache Airflow allows privilege escalation due to improper handling of user input in DAGs. The issue arises when developers utilize examples from the documentation that suggest passing unsanitized values through dag_run.conf. This can allow a malicious user to execute arbitrary code on the worker, compromising system integrity. It is crucial for users to audit their DAG configurations to ensure they are not inadvertently exploiting this flaw by following insecure practices referenced in the documentation.

References