Summary
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen.
Product
Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.
Vulnerabilities 1
-
High 8.8
Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-v5m9-m7pg-q8f3 vom 2026-10-26
https://github.com/advisories/GHSA-v5m9-m7pg-q8f3
-
ASF Mailing List Archives vom 2026-10-26
https://lists.apache.org/thread/k159xrq1tbgmkvl24j63g12qh0mczk79