PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42252 Apache Software Foundation CVE debrief

CVE-2026-42252 documents a documentation-pattern vulnerability in Apache Airflow where the official documentation at `core-concepts/dag-run.html` presented a `BashOperator` example using `dag_run.conf` values without shell-quoting or sanitization warnings. DAG authors who copied this verbatim pattern into production deployments exposed trigger-authorized users to shell metacharacter injection via the `conf` field of the trigger API. The vulnerability affects multi-team deployments and hosted offerings where users hold `Dag.can_trigger` permission. The fix, delivered in `apache/airflow` PR 64129, adds explicit shell-quoting and a safety caveat to the documentation example. This issue is the same class as prior documentation-pattern CVEs CVE-2025-50213 and CVE-2025-27018. The corrected documentation ships with `apache-airflow` 3.2.2 and later.

Vendor
Apache Software Foundation
Product
Apache Airflow
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-21
Advisory published
2026-06-01
Advisory updated
2026-07-21

Who should care

Airflow platform operators, DevSecOps teams managing multi-team Airflow deployments, hosted Airflow service providers, and DAG authors using BashOperator with dag_run.conf interpolation

Technical summary

The pre-correction documentation example `BashOperator(bash_command=echo value: {{ dag_run.conf['conf1'] }})` permitted shell metacharacter injection when trigger API users supplied crafted `conf` values. An authenticated user with `Dag.can_trigger` could inject shell commands (e.g., using `;` metacharacters) that would execute via `os.exec` on the Airflow worker. The fix adds explicit shell-quoting and a safety warning to the documentation pattern. Affects DAGs modeled on the pre-3.2.2 documentation example.

Defensive priority

high

Recommended defensive actions

  • Audit existing DAG code for BashOperator patterns that interpolate dag_run.conf values without shell-quoting or parameterization
  • Upgrade to apache-airflow 3.2.2 or later to obtain corrected documentation and review updated examples
  • Apply defensive quoting (e.g., shlex.quote or equivalent) to all user-controlled values passed to bash_command templates
  • Restrict Dag.can_trigger permissions to trusted users and implement input validation on trigger API conf payloads
  • Review trigger API access controls in multi-team or hosted Airflow deployments to reduce attack surface
  • Reference prior documentation-pattern CVEs CVE-2025-50213 and CVE-2025-27018 for additional hardening guidance

Evidence notes

CVE published 2026-06-01. Documentation correction merged in PR 64129. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) identified by Apache security team. Same vulnerability class as CVE-2025-50213 and CVE-2025-27018.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42252 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42252

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42252 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42252

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.