Apache Airflow example Dag allows shell injection via IPv6 zone (CVE-2026-101031)
Original title: CVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier
The example_dag_decorator Dag places IPv6 zone identifiers into shell commands when triggered with load_examples enabled.
Apache Airflow's example_dag_decorator example Dag uses Python's ipaddress module to validate IP addresses before inserting them into a shell command. This enables arbitrary shell command injection via IPv6 zone identifiers. The flaw affects Airflow versions 3.0.5 before 3.4.0 when example Dags load.
- example_dag_decorator example Dag shipped with Apache Airflow
- ipaddress accepts IPv6 zone identifiers with arbitrary characters
- placed into a shell command
- when example Dags are loaded with load_examples enabled
- user who can trigger that Dag can exploit
Impact: arbitrary shell command injection
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101031 | Shell command injection in Apache Airflow example_dag_decorator Dag | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow 3. 0. 5 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.