CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

As cited

Copy frozen at 2026-10-27 03:15 UTC (site build).

vulnerabilities

CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

Apache Airflow SSH provider versions 4.3.0 before 7.0.1 fail to properly quote environment variable values in SSHRemoteJobOperator, allowing shell commands like $(…) to execute on the remote SSH host. The vulnerability affects workflows that pass user-controlled input such as dag parameters to the operator.

Why it matters: Teams using Apache Airflow SSH provider with SSHRemoteJobOperator and dynamic parameters risk arbitrary command execution on remote systems; update to version 7.0.1 or later.

Source published

2026-10-26 23:06 UTC

First seen by Cybersecurity Tracker

2026-10-27 01:14 UTC