Cyber ·
CVE-2026-111422: Apache Airflow SSH provider runs environment values as remote shell
Low-severity advisory for the Apache Airflow SSH provider before version 7.0.1. Values of the environment parameter were inserted into an already quoted wrapper script, so shell syntax such as $(...) could run on the remote SSH host. The advisory was published on October 26, 2026.
On October 26, 2026, identifier CVE-2026-111422 was disclosed on the oss-sec feed, concerning the Apache Airflow SSH provider. According to the text received, the flaw affects version 4.3.0 up to but not including 7.0.1, and its severity is rated low.
The problem lies in the SSHRemoteJobOperator. Values of the environment parameter were quoted only once, although they were placed inside a wrapper script that was already quoted. As a result, shell syntax such as $(...) in a value could run on the remote SSH host. The advisory cites as a relevant case a DAG that passes inputs supplied at trigger time, such as params.
The text received indicates the fix is in version 7.0.1 of the provider. To check exposure, confirm the installed version of the apache-airflow-providers-ssh package and note whether DAGs pass external values into environment. The full description, including any additional recommendations, is in the original advisory, which should be consulted directly before any decision.
Rota Nacional does not fix or replace Apache Airflow and does not solve this engineering flaw. This record is informational only for teams operating pipelines with this provider.