CVE-2026-30898
Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
概要
Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.
影響パッケージ
Bitnami
airflow
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]
参照URL
- advisory lists.apache.org
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web openwall.com
- web pypi.python.org