CVE-2026-30898

Description: BashOperator renders bash_command through Jinja2 with dag_run.conf values supplied at trigger time, then hands the resulting string to subprocess.run(["bash", "-c", ...]). A DAG written against the documented example turns anyone who can trigger it into a shell on the worker.

The finding turned on documentation rather than on the sink. The same pattern appears three times in Airflow's own docs, treated three different ways: the getting-started guide teaches it as the primary example with no warning, the provider docs carry a caution block, and the operator docstring says "DO NOT DO THIS". Affects Airflow 3.1.7 and earlier.

Impact: Privilege escalation to code execution on the worker, for any principal able to trigger a DAG.

Fixed in 3.2.0 (2026-04-07) by PR #64129, which is documentation only. The sink is unchanged, so the vulnerability is still present wherever the old example was copied, and every DAG already written against it needs auditing by hand. Upgrading fixes the example, not the DAGs.

Jarek Potiuk on the Airflow security team accepted the CVE once the internal inconsistency was specific, following the precedent of CVE-2025-50213 and CVE-2025-27018 for assigning a CVE when official documentation teaches an unsafe pattern. The ASF assesses this as Low severity; the 8.8 recorded here is the CVSS v3.1 base score published on the CVE record. Full analysis is in the technical whitepaper.