---
id: "CVE-2026-111422"
kind: "vulnerability"
aliases: ["CVE-2026-111422"]
title: "Airflow SSH provider: templated environment values run shell commands remotely"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["airflow", "package", "python", "ssh"]
not_affected_if: ["no-sshremotejoboperator", "no-trigger-time-environment-input"]
published_at: "2026-10-27T00:17:09+00:00"
first_seen_at: "2026-10-27T00:25:55+00:00"
updated_at: "2026-10-27T00:26:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111422", "first_seen_at": "2026-10-27T00:25:55+00:00"}]
---

# Airflow SSH provider: templated environment values run shell commands remotely

In apache-airflow-providers-ssh before 7.0.1, the SSHRemoteJobOperator quotes its templated environment values only once inside an already-quoted wrapper script, so shell syntax such as $(...) in a value executes on the remote SSH host. A user who can trigger a Dag with trigger-time input like params or dag_run.conf, but cannot author Dags, can run arbitrary commands as the SSH connection's user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show apache-airflow-providers-ssh` and see whether it is below `7.0.1`.
- Search Dags for `SSHRemoteJobOperator` with an `environment` argument that uses `params` or `dag_run.conf` templates.

## Fix

- Upgrade `apache-airflow-providers-ssh` to `7.0.1` or later.

## Timeline

- 2026-10-27T00:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111422

## From the sources

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as `params` or `dag_run.conf` into `environment`, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_