Airflow SSH provider before 7.0.1 runs environment values as shell
Original title: CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
SSHRemoteJobOperator quotes templated environment values only once inside an already-quoted wrapper, so $(...) runs remotely.
Hussein Awala reported CVE-2026-111422 in the Apache Airflow SSH provider on October 26, rated low. In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quotes values of the templated environment parameter only once even though they sit inside an already-quoted wrapper script. Shell syntax such as $(...) in a value is therefore executed on the remote SSH host. The listed fix is 7.0.1; the post is cut off while discussing Dag trigger-time input.
Unconfirmed: The post is cut off before fully describing trigger-time Dag inputs.
- Posted severity is low.
- Affected versions are Apache Airflow SSH provider 4.3.0 before 7.0.1.
- The named fixed release is 7.0.1.
- The flawed component is SSHRemoteJobOperator.
Impact: Shell syntax in environment values runs on the remote host
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow SSH provider | 4.3.0 before 7.0.1 | 7.0.1 |
- 1.Upgrade apache-airflow-providers-ssh to 7.0.1.
- CVEs
- CVE-2026-111422
- Vendors
- Apache
- Products
- Apache Airflow SSH provider
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111422 | Command injection in Airflow SSH provider environment values | 8.8 | — |
From the original article
Posted by Hussein Awala on Oct 26 Severity: low Affected versions: - Apache Airflow SSH provider 4. 3. 0 before 7.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.