PatchSiren cyber security CVE debrief
CVE-2026-42252 Apache Software Foundation CVE debrief
CVE-2026-42252 documents a documentation-pattern vulnerability in Apache Airflow where the official documentation at `core-concepts/dag-run.html` presented a `BashOperator` example using `dag_run.conf` values without shell-quoting or sanitization warnings. DAG authors who copied this verbatim pattern into production deployments exposed trigger-authorized users to shell metacharacter injection via the `conf` field of the trigger API. The vulnerability affects multi-team deployments and hosted offerings where users hold `Dag.can_trigger` permission. The fix, delivered in `apache/airflow` PR 64129, adds explicit shell-quoting and a safety caveat to the documentation example. This issue is the same class as prior documentation-pattern CVEs CVE-2025-50213 and CVE-2025-27018. The corrected documentation ships with `apache-airflow` 3.2.2 and later.
- Vendor
- Apache Software Foundation
- Product
- Apache Airflow
- CVSS
- Unknown
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Airflow platform operators, DevSecOps teams managing multi-team Airflow deployments, hosted Airflow service providers, and DAG authors using BashOperator with dag_run.conf interpolation
Technical summary
The pre-correction documentation example `BashOperator(bash_command=echo value: {{ dag_run.conf['conf1'] }})` permitted shell metacharacter injection when trigger API users supplied crafted `conf` values. An authenticated user with `Dag.can_trigger` could inject shell commands (e.g., using `;` metacharacters) that would execute via `os.exec` on the Airflow worker. The fix adds explicit shell-quoting and a safety warning to the documentation pattern. Affects DAGs modeled on the pre-3.2.2 documentation example.
Defensive priority
high
Recommended defensive actions
- Audit existing DAG code for BashOperator patterns that interpolate dag_run.conf values without shell-quoting or parameterization
- Upgrade to apache-airflow 3.2.2 or later to obtain corrected documentation and review updated examples
- Apply defensive quoting (e.g., shlex.quote or equivalent) to all user-controlled values passed to bash_command templates
- Restrict Dag.can_trigger permissions to trusted users and implement input validation on trigger API conf payloads
- Review trigger API access controls in multi-team or hosted Airflow deployments to reduce attack surface
- Reference prior documentation-pattern CVEs CVE-2025-50213 and CVE-2025-27018 for additional hardening guidance
Evidence notes
CVE published 2026-06-01. Documentation correction merged in PR 64129. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) identified by Apache security team. Same vulnerability class as CVE-2025-50213 and CVE-2025-27018.
Official resources
2026-06-01