CVE-2026-30898

CVE-2026-30898 affects Apache Airflow and stems from insecure documentation guidance for the BashOperator that demonstrates improper handling of dag_run.conf parameters. The vulnerability allows unsanitized user input to be passed through DAG configurations, potentially enabling privilege escalation for UI users to execute arbitrary code on worker nodes. Organizations using Airflow should audit their DAGs to ensure they have not implemented the flawed pattern described in the affected documentation. The vulnerability carries a HIGH severity rating with a CVSS score of 8.8, reflecting its network-based attack vector, low complexity, and requirement for low privileges. The impact is significant, with potential for high confidentiality, integrity, and availability compromise, as attackers could gain code execution capabilities on worker infrastructure. This represents a substantial risk to affected environments due to the potential for lateral movement and data exfiltration. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on security tracking hot lists. The EPSS score of 0.00068 indicates low probability of exploitation relative to other CVEs, suggesting limited immediate threat; however, organizations should still prioritize remediation through DAG review and implementation of proper input sanitization practices.