{"id":"CVE-2026-111422","aliases":[],"title":"Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host","titleSource":"apache","descriptionSource":"apache","products":[{"vendor":"Apache Software Foundation","name":"Apache Airflow SSH provider","platforms":[],"versions":[{"version":"4.3.0","status":"affected","lessThan":"7.0.1","versionType":"semver"}],"defaultStatus":"unaffected","source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111422"}],"remediation":[],"description":"In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as `params` or `dag_run.conf` into `environment`, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.","severity":"unknown","score":null,"published":"2026-10-26T23:29:30.363Z","modified":"2026-10-27T00:17:16.330Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/apache/airflow/pull/74810","https://lists.apache.org/thread/k159xrq1tbgmkvl24j63g12qh0mczk79","https://airflow.apache.org/docs/apache-airflow-providers-ssh/7.0.1/changelog.html"],"sources":[{"name":"CVE","id":"CVE-2026-111422","modified":"2026-10-27T00:17:16.330Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111422"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T17:50:31.025Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}