Apache Airflow: Shell command injection in example_dag_decorator (CVE-2026-101031)
The `example_dag_decorator` DAG in Apache Airflow versions 3.0.5 through 3.3.x is vulnerable to shell command injection via IPv6 zone identifiers when example DAGs are enabled.
CVE search metadata
CVE search record: CVE-2026-101031. KEV: no. Product: Airflow (3.0.5 through 3.3.x). Brief: Apache Airflow: Shell command injection in example_dag_decorator (CVE-2026-101031). Brief link: https://feed.craftedsignal.io/briefs/2026-11-airflow-shell-injection/
Triage facts
Revision 1- Applicability
- Airflow (3.0.5 through 3.3.x)
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 09:13 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
The example_dag_decorator example DAG shipped with Apache Airflow validates an IP address using Python's ipaddress module and passes it into a shell command. Because ipaddress accepts IPv6 zone identifiers containing arbitrary characters, a user who can trigger the DAG when example DAGs are enabled can facilitate shell command injection.