Critical vulnerability
Critical remote code execution in Apache Airflow (CVE-2026-101031)
Remote code execution in Apache Airflow · Servers and applications
CVE-2026-101031
Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier
- Severity
- Critical 9.1
- Published
- 9 Nov 2026
- Fixed in
- 3.4.0
- Exploit chance
- 0.2% in the next 30 daysHigher than 11% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- OS command injection (CWE-78)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read data · Change data
The example_dag_decorator example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's ipaddress module and then placed it into a shell command. ipaddress accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (load_examples enabled), a user who can trigger that Dag with a custom url parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (load_examples = False), which is recommended for production.
| Software | Affected versions |
|---|---|
| Apache AirflowServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-101031
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.