CVE-2026-30898 json
Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
published 2026-04-18 6 mo ago modified 2026-11-03 6 d ago also BIT-airflow-2026-30898 , EUVD-2026-23660
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.
Patch / fix
- bitnami airflow 3.2.0
- Apache Software Foundation Apache Airflow 3.0.0, 3.2.0
- github.com/apache/airflow#64129 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | airflow | <3.2.0 |
3.2.0 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/apache/airflow/pull/64129
patch, issue-tracking, report
-
lists.apache.org
/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8
vendor-advisory, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/04/17/7
mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-30898
web
Sources
- CVE List CVE-2026-30898
- NVD CVE-2026-30898
- OSV BIT-airflow-2026-30898
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.