CVE-2022-40127: A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided…

PriorityP180high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

85.65%

99.7th percentile

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	airflow	< 2.4.0	2.4.0
apache_software_foundation	apache_airflow	>= Apache Airflow < 2.4.0	2.4.0

Detection & IOCsextracted from sources · hover to see the quote

pathairflow/example_dags/example_bash_operator.py↗

path/tmp/success↗

→Monitor for shell metacharacters (backticks, $(), semicolons) injected into the run_id parameter when triggering DAGs via the Airflow UI, specifically targeting the 'Trigger DAG w/ config' functionality. ↗
→Detect exploitation attempts against the example_bash_operator DAG: look for run_id values containing shell command injection patterns in Airflow trigger requests. ↗
→Alert on the presence and execution of example DAGs (example_bash_operator) on production Airflow instances, as these are the attack surface for this CVE. ↗
→The vulnerable template expression is `echo "run_id={{ run_id }} | dag_run={{ dag_run }}"` — monitor Airflow task logs for unexpected command output or OS-level process spawning from this BashOperator task. ↗

·Exploitation requires the attacker to have UI access and the ability to trigger DAGs; example DAGs must be enabled on the instance. ↗
·This vulnerability only affects Apache Airflow versions prior to 2.4.0. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.