Airflow (3.0.5 Through 3.3.x) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/airflow-3.0.5-through-3.3.x/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 09:13:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Airflow: Shell command injection in example_dag_decorator (CVE-2026-101031)https://feed.craftedsignal.io/briefs/2026-11-airflow-shell-injection/Mon, 09 Nov 2026 09:13:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-airflow-shell-injection/The `example_dag_decorator` DAG in Apache Airflow versions 3.0.5 through 3.3.x is vulnerable to shell command injection via IPv6 zone identifiers when example DAGs are enabled.The example_dag_decorator example DAG shipped with Apache Airflow validates an IP address using Python's ipaddress module and passes it into a shell command. Because ipaddress accepts IPv6 zone identifiers containing arbitrary characters, a user who can trigger the DAG when example DAGs are enabled can facilitate shell command injection.

]]>lowadvisory