CVE-2026-30898
Published: 18 April 2026
Summary
CVE-2026-30898 is a high-severity Command Injection (CWE-77) vulnerability in Apache Airflow. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 49.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-30898 is a high-severity vulnerability (CVSS 8.8) stemming from an incorrect example in the Apache Airflow documentation for the BashOperator. The flawed guidance suggested a method of passing dag_run.conf that could result in unsanitized user input being executed, enabling command injection (CWE-77). This affects Apache Airflow deployments where users have adopted the erroneous documentation in their own DAGs, potentially exposing the worker nodes to privilege escalation from UI users.
An authenticated attacker with low privileges (PR:L), such as a standard Airflow UI user, can exploit this over the network (AV:N) with low complexity and no user interaction required. Successful exploitation allows the attacker to escalate privileges and execute arbitrary code on the Airflow worker, achieving high confidentiality, integrity, and availability impacts (C:H/I:H/A:H).
Advisories recommend that Airflow users immediately review and audit their DAGs for any implementation following the vulnerable BashOperator example. The Apache Airflow project addressed the issue via a documentation pull request (https://github.com/apache/airflow/pull/64129), with further details in mailing list announcements (https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8) and OSS-Security (http://www.openwall.com/lists/oss-security/2026/04/17/7), emphasizing proactive DAG validation over a specific patch.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23660
Vulnerability details
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review…
more
if any of their own DAGs have adopted this incorrect advice.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables post-auth command injection via unsanitized dag_run.conf in BashOperator, directly allowing arbitrary Unix shell command execution (T1059.004) and privilege escalation to code execution on workers (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection (CWE-77) by requiring validation and sanitization of unsanitized user inputs from dag_run.conf before execution in BashOperator.
Requires organizations to identify, report, and correct flaws in custom DAGs that adopted the vulnerable BashOperator example from Airflow documentation.
Ensures configuration changes to DAGs are reviewed, tested, and approved to prevent deployment of vulnerable patterns allowing privilege escalation.