Apache Airflow Teradata Provider Vulnerability in Compute-Cluster Example Dag
CVE-2026-86843

6.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Airflow Teradata Provider
Vendor
CVE Published:
29 September 2026

What is CVE-2026-86843?

The Apache Airflow Teradata provider contains a vulnerability in its compute-cluster example Dag, where all Dag Params were declared as unconstrained free text. This issue allows users with lower trust roles to input SQL fragments that are executed with the privileges of the task's connection, potentially redirecting the task to execute under any connection defined within the deployment. Upgrading to version 3.7.0 or later is recommended, as it constrains parameters to verified identifiers and restricts input to a closed set, thereby preventing unauthorized SQL execution.

Affected Version(s)

Apache Airflow Teradata provider 0 < 3.7.0

References

https://github.com/apache/airflow/pull/72714
patch
https://lists.apache.org/thread/js9pmhj1j6552gpn1j8wdz579...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Rukin (Arenadata)
Jarek Potiuk
.