CVE-2026-111422
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
68/100
Published: 2026-10-27
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as `params` or `dag_run.conf` into `environment`, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache Airflow SSH provider | 4.3.0 < 7.0.1 |
| Apache Software Foundation | Apache Airflow SSH provider | 4.3.0 < 7.0.1 |
| Apache Software Foundation | Apache Airflow SSH provider | 4.3.0 < 7.0.1 |