Live › vulnerability › CVE-2026-111422
Go to dashboardIn apache-airflow-providers-ssh before 7.0.1, the SSHRemoteJobOperator quotes its templated environment values only once inside an already-quoted wrapper script, so shell syntax such as $(...) in a value executes on the remote SSH host. A user who can trigger a Dag with trigger-time input like params or dag_run.conf, but cannot author Dags, can run arbitrary commands as the SSH connection's user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Teams running Airflow with the SSH provider before 7.0.1 that use SSHRemoteJobOperator and pass trigger-time input such as params or dag_run.conf into its environment parameter. Deployments without that operator or without user-supplied values in environment are not exposed by this description.
No product ranges from the sources yet.
pip show apache-airflow-providers-ssh and see whether it is below 7.0.1.SSHRemoteJobOperator with an environment argument that uses params or dag_run.conf templates.apache-airflow-providers-ssh to 7.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $(...) in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as params or dag_run.conf into environment, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.
This page as .md · .json · in your agent: get_signal("CVE-2026-111422")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.