All vulnerabilities
CVE-2026-111422

Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

Apache Software Foundation Apache Airflow SSH provider
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7.0.1Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 7.0.1Apache Airflow SSH providerCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $(...) in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as params or dag_run.conf into environment, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.

Text from CVE List

Affected versions 1

  • Apache Airflow SSH provideraffected: 4.3.0 before 7.0.1CVE List

References 3