Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Airflow SSH provider

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-111422

    Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

    In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed…

    Apache Software Foundation Apache Airflow SSH provider