Shell Metacharacter Injection Vulnerability in Apache Airflow

CVE-2026-42252

What is CVE-2026-42252?

This vulnerability in Apache Airflow arises from a lack of proper quoting and sanitization in the documentation example for using the BashOperator. Authors of DAGS could directly copy these patterns into their deployments, potentially exposing their systems to shell metacharacter injection attacks when users with the 'Dag.can_trigger' permission invoke the trigger API. An attacker could exploit this by supplying malicious input via the 'conf' field, leading to arbitrary command execution on the worker. The associated documentation has been corrected in the latest release to include proper shell quoting and a significant safety caveat. Users are strongly recommended to upgrade to Apache Airflow version 3.2.2 or later to mitigate this vulnerability.

References