CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

The Apache Airflow Teradata provider's compute-cluster example Dag treated every Dag Param as unconstrained free text and templated those values into compute-cluster operators that interpolate them into Teradata DDL. A user allowed to trigger the Dag, a lower-trust role that does not need its own Teradata credentials, could inject SQL fragments that run as the task's connection and could point the task at any other connection in the deployment because the connection id was also a free-text Param. Only deployments that run this example Dag, or a Dag copied from it, are affected; the provider's operator code is unchanged. Users should upgrade to apache-airflow-providers-teradata 3.7.0 or later, which constrains Params to validated identifiers and a closed set and removes connection selection and free-form option strings from trigger-time input. No public proof-of-concept is known and the issue is not listed in CISA KEV.