CVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

The Brief

Apache Airflow's shipped example_dag_decorator example Dag had a shell command injection flaw, tracked as CVE-2026-101031.
The Dag validated an IP address fetched over HTTP with Python's ipaddress module, then placed it into a shell command, and the IPv6 zone identifier allowed injection.
Affected versions are Apache Airflow 3.0.5 before 3.4.0, and the advisory rates severity as low.

Why it matters

Only deployments that run the example Dag and handle HTTP-fetched IPv6 addresses are at risk, but the flaw shows how unvalidated input can reach a shell command even after an IP check.

Who’s affected

Apache Airflow users running 3.0.5 before 3.4.0
Teams running the example_dag_decorator example Dag

What to do

Upgrade Apache Airflow to 3.4.0 or later.
Check whether the example_dag_decorator example Dag is deployed in your environment.

Apache Airflow 3.0.5
Apache Airflow 3.4.0
CVE-2026-101031
#apache-airflow
#security
#shell-injection
#cve
#python
#ipv6

Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow 3.0.5 before 3.4.0 Description: The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it…

Read the full story at seclists.org ↗

Timeline

Nov 8
Vulnerability posted to oss-sec by Rahul Vats
Nov 9 · 7:17 AM
Open Source Security
CVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier