Is CVE-2026-42252 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42252 being exploited in the wild.

How severe is CVE-2026-42252?

Critical severity, with a CVSS score of 9.1, published 1 June 2026.

Which products and versions are affected?

Apache Airflow Before 3.2.2; apache-airflow (PyPI) >= 3.0.0, < 3.2.2, ECOSYSTEM:introduced=3.0.0,fixed=3.2.2.

Is there a fix for CVE-2026-42252?

Yes. apache-airflow (PyPI): upgrade to 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42252 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42252?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42252: Apache Airflow command injection via unsafe documentation example

Q: Is there a fix for CVE-2026-42252?

Yes. apache-airflow (PyPI): upgrade to 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42252 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-42252?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42252 · Severity: critical · CVSS 9.1 · Published 2026-06-01

Apache Airflow is an open-source platform used to schedule and monitor complex workflows. A vulnerability was identified in its official documentation that provided an insecure code example for passing parameters to tasks. If developers used this example verbatim, an attacker with permission to trigger workflows could execute malicious commands on the underlying server, potentially leading to a full system takeover or unauthorized data access.

Technologies: Apache Airflow, apache-airflow (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2026-42252 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42252 being exploited in the wild.
How severe is CVE-2026-42252?: Critical severity, with a CVSS score of 9.1, published 1 June 2026.
Which products and versions are affected?: Apache Airflow Before 3.2.2; apache-airflow (PyPI) >= 3.0.0, < 3.2.2, ECOSYSTEM:introduced=3.0.0,fixed=3.2.2.
Is there a fix for CVE-2026-42252?: Yes. apache-airflow (PyPI): upgrade to 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42252 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42252?: Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 3.2.2 or later
```
pip install "apache-airflow>=3.2.2"
```

Technical details

The vulnerability stems from an insecure Jinja2 template pattern in the official Apache Airflow documentation for 'Passing Parameters when triggering Dags'. The documentation suggested using BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }}") without proper shell quoting or sanitization. An authenticated attacker with 'Dag.can_trigger' permissions can exploit this by providing a malicious payload (e.g., shell metacharacters) in the 'conf' field of a DAG trigger request. This results in arbitrary command execution (RCE) via os.exec on the Airflow worker. The fix involves updating documentation to use explicit shell-quoting and upgrading to version 3.2.2.

Affected products

Apache Software Foundation Apache Airflow >= 3.0.0, < 3.2.2

Identifiers

CVE-2026-42252
GHSA-c85c-g9wv-pph2
PYSEC-2026-184

Timeline

2026-03-24: patched: Documentation fix merged in PR 64129
2026-06-01: disclosed: CVE-2026-42252 published
2026-06-01: advisory: GHSA-c85c-g9wv-pph2 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.