4 matches found
EUVD-2026-110536
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $... in a value was executed on the remote SSH host. In a Dag that passe...
CVE-2026-111422
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $... in a value was executed on the remote SSH host. In a Dag that passe...
CVE-2026-111422
The apache-airflow-providers-ssh component (before version 7.0.1 ) contains a vulnerability in the SSHRemoteJobOperator where values in the templated environment parameter are quoted only once. Because these values are placed inside an already-quoted wrapper script, shell syntax like $(...) can b...
CVE-2026-111422 Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $... in a value was executed on the remote SSH host. In a Dag that passe...