{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apache-airflow-ssh-provider-4.3.0---7.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:airflow_ssh_provider:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-111422"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache Airflow SSH provider (4.3.0 - 7.0.0)"],"_cs_severities":["low"],"_cs_tags":["airflow","command-injection","rce"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Airflow SSH provider versions 4.3.0 through 7.0.0 are vulnerable to command injection via the \u003ccode\u003eSSHRemoteJobOperator\u003c/code\u003e. The vulnerability stems from improper quoting of the templated \u003ccode\u003eenvironment\u003c/code\u003e parameter. Because the values are placed within an already-quoted wrapper script without sufficient escaping, an attacker providing malicious input (such as command substitution syntax \u003ccode\u003e$(...)\u003c/code\u003e) via DAG parameters can cause the remote SSH host to execute arbitrary shell commands.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution on the target host defined in the SSH connection. This may lead to unauthorized access to the target infrastructure, privilege escalation, or lateral movement from the Airflow environment to the SSH-connected system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eapache-airflow-providers-ssh\u003c/code\u003e package to version 7.0.1 or later.\u003c/li\u003e\n\u003cli\u003eAudit existing DAGs using \u003ccode\u003eSSHRemoteJobOperator\u003c/code\u003e to ensure that input passed into the \u003ccode\u003eenvironment\u003c/code\u003e parameter is strictly validated and does not contain shell metacharacters or command substitution sequences.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T00:32:41Z","date_published":"2026-10-27T00:32:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-airflow-ssh-injection/","summary":"A command injection vulnerability in the Apache Airflow SSH provider allows attackers to achieve remote code execution on SSH hosts by injecting shell syntax into the environment parameter of SSHRemoteJobOperator.","title":"Apache Airflow SSH provider: Command injection in SSHRemoteJobOperator (CVE-2026-111422)","url":"https://feed.craftedsignal.io/briefs/2026-10-airflow-ssh-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Apache Airflow SSH Provider (4.3.0 - 7.0.0)","version":"https://jsonfeed.org/version/1.1"}