CVE-2026-111422 in Airflow SSH Provider
Summary
by MITRE • 10/27/2026
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as `params` or `dag_run.conf` into `environment`, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Apache Airflow providers for SSH prior to version 7.0.1 represents a critical command injection flaw rooted in improper input sanitization and shell escaping mechanisms within the SSHRemoteJobOperator component. This operator is responsible for executing tasks on remote hosts via Secure Shell connections, often utilizing templated environment variables to configure the execution context of those jobs. The core technical failure lies in how these environment variable values are processed before being passed to the underlying operating system's command interpreter. Specifically, when constructing the shell script that wraps the actual job execution, the operator applies a single layer of quoting around user-supplied values. However, because this quoted string is subsequently embedded within another set of quotes or a context where further shell expansion occurs, the initial escaping proves insufficient to neutralize special shell metacharacters. This double-encoding failure allows attackers to break out of the intended variable scope and inject arbitrary commands that are interpreted by the remote shell during execution.
The operational impact of this vulnerability is severe, particularly in environments where Airflow DAGs accept dynamic input from users who do not have authoring privileges but possess trigger permissions. If a Data Access Graph or workflow configuration allows parameters such as dag_run.conf or task instance params to be directly mapped into the environment variables used by SSHRemoteJobOperator, an attacker can exploit this flaw to achieve remote code execution on the target host. By crafting specific input strings containing shell syntax like command substitution using dollar-parentheses notation, a malicious user can force the remote server to execute arbitrary commands under the privileges of the SSH connection user. This effectively bypasses access controls intended for DAG authors and grants unauthorized users significant control over the infrastructure connected via Airflow's SSH provider, potentially leading to data exfiltration, lateral movement within the network, or complete compromise of the affected systems depending on the permissions assigned to that specific service account.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector leverages ATT&CK technique T1059.004, specifically the use of Unix Shell Commands for execution. The flaw exploits a fundamental misunderstanding or misimplementation of shell quoting rules, where developers assumed that wrapping input in quotes was sufficient to prevent interpretation by the command line interpreter. In reality, nested contexts and variable expansion within bash-like shells require more rigorous escaping strategies, such as using functions like shlex.quote in Python or ensuring multiple layers of sanitization when values are embedded in complex script structures. The failure to account for these nuances results in a predictable path for exploitation that does not necessarily require authentication beyond the ability to trigger specific workflows.
Mitigation requires immediate upgrading of the apache-airflow-providers-ssh package to version 7.0.1 or any later release where this quoting logic has been corrected to properly escape special characters and prevent shell injection. In addition to patching, organizations should review their DAG configurations to ensure that user-supplied inputs are not directly passed into environment variables used by SSH operators without additional validation layers. Implementing strict allow-lists for expected input formats or using Airflow's built-in templating features more securely can further reduce the risk surface. Security teams should also audit existing workflows for similar patterns where dynamic data influences shell command construction, ensuring that all external inputs are treated as untrusted and subjected to rigorous sanitization before being processed by system-level interpreters.