High severity8.8NVD Advisory· Published Apr 18, 2026· Updated Apr 21, 2026

CVE-2026-30898

Description

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Airflow
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
Range: <3.2.0
osv-coords
pkg:bitnami/airflow
Range: < 3.2.0

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/04/17/7nvdMailing ListThird Party Advisory
lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8nvdVendor AdvisoryMailing List
github.com/apache/airflow/pull/64129nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000