PYSEC-2026-1135

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2026-1135.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1135
Aliases
Published
2026-07-07T16:03:09.057395Z
Modified
2026-07-07T17:56:51.615482094Z
Severity
  • 5.2 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Apache Airflow has a command injection vulnerability in "example_dag_decorator"
Details

An example dag example_dag_decorator had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the example_dag_decorator please review it and apply the changes implemented in Airflow 3.0.5 accordingly.

References

Affected packages

PyPI / apache-airflow

Package

Name
apache-airflow
View open source insights on deps.dev
Purl
pkg:pypi/apache-airflow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.5

Affected versions

3.*
3.0.0
3.0.1rc1
3.0.1
3.0.2rc1
3.0.2rc2
3.0.2
3.0.3rc1
3.0.3rc2
3.0.3rc3
3.0.3rc4
3.0.3rc5
3.0.3rc6
3.0.3
3.0.4rc1
3.0.4rc2
3.0.4
3.0.5rc1
3.0.5rc2
3.0.5rc3

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2026-1135.yaml"