Apache Airflow SSH Provider (4.3.0 - 7.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/apache-airflow-ssh-provider-4.3.0---7.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 00:32:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Airflow SSH provider: Command injection in SSHRemoteJobOperator (CVE-2026-111422)https://feed.craftedsignal.io/briefs/2026-10-airflow-ssh-injection/Tue, 27 Oct 2026 00:32:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-airflow-ssh-injection/A command injection vulnerability in the Apache Airflow SSH provider allows attackers to achieve remote code execution on SSH hosts by injecting shell syntax into the environment parameter of SSHRemoteJobOperator.Apache Airflow SSH provider versions 4.3.0 through 7.0.0 are vulnerable to command injection via the SSHRemoteJobOperator. The vulnerability stems from improper quoting of the templated environment parameter. Because the values are placed within an already-quoted wrapper script without sufficient escaping, an attacker providing malicious input (such as command substitution syntax $(...)) via DAG parameters can cause the remote SSH host to execute arbitrary shell commands.

Impact

Successful exploitation allows for remote code execution on the target host defined in the SSH connection. This may lead to unauthorized access to the target infrastructure, privilege escalation, or lateral movement from the Airflow environment to the SSH-connected system.

Recommendation

  • Upgrade the apache-airflow-providers-ssh package to version 7.0.1 or later.
  • Audit existing DAGs using SSHRemoteJobOperator to ensure that input passed into the environment parameter is strictly validated and does not contain shell metacharacters or command substitution sequences.
]]>lowadvisoryairflowcommand-injectionrce