CVE-2026-30898

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30898", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-06T16:58:56.509Z", "datePublished": "2026-04-18T06:20:48.647Z", "dateUpdated": "2026-11-03T06:53:17.291Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:53:17.291Z"}, "title": "Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf", "problemTypes": [{"descriptions": [{"description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "cweId": "CWE-77", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0", "versionType": "semver"}], "defaultStatus": "unaffected", "packageURL": "pkg:pypi/apache-airflow"}, {"vendor": "Apache Software Foundation", "product": "Apache Airflow", "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow-core", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.2.0", "versionType": "semver"}], "defaultStatus": "unaffected", "packageURL": "pkg:pypi/apache-airflow-core"}], "descriptions": [{"value": "An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.<br>"}]}], "references": [{"url": "https://github.com/apache/airflow/pull/64129", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "credits": [{"lang": "en", "value": "Peyton Kennedy (p80n-sec) from Endor Labs", "type": "finder"}, {"lang": "en", "value": "Kevin Yang", "type": "remediation developer"}], "x_generator": {"engine": "airflow-s/generate_cve_json.py"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/17/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-18T06:28:55.918Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-30898"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T03:55:38.783Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/17/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-18T06:28:55.918Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-30898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T15:59:20.356299Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:00:31.474Z"}}], "cna": {"title": "Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Peyton Kennedy (p80n-sec) from Endor Labs"}, {"lang": "en", "type": "remediation developer", "value": "Kevin Yang"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow", "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.2.0", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow-core", "packageName": "apache-airflow-core", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/64129", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "airflow-s/generate_cve_json.py"}, "descriptions": [{"lang": "en", "value": "An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.", "supportingMedia": [{"type": "text/html", "value": "An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:53:17.291Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30898", "state": "PUBLISHED", "dateUpdated": "2026-11-03T06:53:17.291Z", "dateReserved": "2026-03-06T16:58:56.509Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-18T06:20:48.647Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow", "packageURL": "pkg:pypi/apache-airflow", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-core", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.2.0", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "98A505A1-464C-4895-A628-9D8BEA1458E4", "versionEndExcluding": "3.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice."}, {"lang": "es", "value": "Un ejemplo de BashOperator en la documentaci\u00f3n de Airflow suger\u00eda una forma de pasar dag_run.conf de una manera que podr\u00eda causar que la entrada de usuario no saneada se utilizara para escalar privilegios del usuario de la UI y permitir la ejecuci\u00f3n de c\u00f3digo en el worker. Los usuarios deber\u00edan revisar si alguno de sus propios DAGs ha adoptado este consejo incorrecto."}], "id": "CVE-2026-30898", "lastModified": "2026-11-03T07:19:02.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30898", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-04-18T07:16:10.297", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking"], "url": "https://github.com/apache/airflow/pull/64129"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/17/7"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Airflow", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "airflow", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-20T18:43:40.790201+00:00", "value": {"mitigation_remediation": ["Review all DAGs that use BashOperator and verify whether dag_run.conf values are directly passed to the shell command.", "Sanitise or escape all dag_run.conf inputs before they reach the BashOperator, or use safe parameterisation alternatives such as templating or argument lists.", "Restrict or disable the ability for untrusted users to submit dag_run.conf through the UI for DAGs that run with elevated privileges.", "Check for and apply any newer Apache Airflow releases that address this issue, even if the advisory does not list an explicit patch."], "summary": {"action": "Assess Impact", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All Apache Airflow installations that have adopted the documented pattern for passing dag_run.conf values to the BashOperator are potentially affected. No specific product version was listed in the advisory, so the risk applies broadly to deployments that follow the insecure pattern.", "description_and_impact": "Based on the description, an example in the Apache Airflow documentation shows that passing user\u2011provided dag_run.conf values directly into a BashOperator can cause unsanitized input to be executed as shell commands. The vulnerability is a classic command injection scenario (CWE\u201177). If successfully exploited, an attacker could run arbitrary code on the worker that executes the DAG, effectively gaining remote code execution privileges on that host.", "risk_and_exploitability": "The likely attack vector is through the Airflow web UI or API by supplying crafted dag_run.conf data for a DAG that uses the BashOperator. Because the conf data is concatenated directly into the shell command, a single malicious entry can execute arbitrary commands with the privileges of the worker process. The CVSS score is 8.8, indicating high severity. EPSS is reported as <1%, indicating a low exploitation probability, and the issue is not listed in the CISA KEV catalog."}}}}, "created": "2026-04-18T09:00:05.715101+00:00", "updated": "2026-04-20T18:45:14.232724+00:00", "vendors": ["apache", "apache$PRODUCT$airflow"]}