UNKNOWN NVD
CVE-2026-101031
The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed i
The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.
References
- https://github.com/apache/airflow/pull/73787
- https://lists.apache.org/thread.html/p53zxybld58wv722c7zxk0w8d2rnkfwk
- https://www.cve.org/CVERecord?id=CVE-2025-54941
- https://www.openwall.com/lists/oss-security/2026/11/09/11
This unknown severity vulnerability was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.