Apache Airflow BashOperator Privilege Escalation Vulnerability via Unsanitized dag_run.conf Input

A vulnerability exists in Apache Airflow versions prior to 3.2.0, where an example in the documentation incorrectly suggested how to use the BashOperator with Jinja templating. This could lead to unsanitized user input being used to escalate the privileges of a UI user, allowing them to execute code on a worker. Users are advised to check their own Directed Acyclic Graphs (DAGs) for adherence to this flawed guidance.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing a user to execute arbitrary code on an Airflow worker.

Remediation

Users should update to Apache Airflow version 3.2.0 or later. For those who have followed the incorrect documentation example, review and revise the affected DAGs to ensure they do not introduce this vulnerability.