# CVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/591) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-101031-apache-airflow-shell-command-injection-in-the-example-dag-decora-0bab53b80ab6f311
Kind: security · Impact: low

## In brief

- Apache Airflow's shipped example_dag_decorator example Dag had a shell command injection flaw, tracked as CVE-2026-101031.
- The Dag validated an IP address fetched over HTTP with Python's ipaddress module, then placed it into a shell command, and the IPv6 zone identifier allowed injection.
- Affected versions are Apache Airflow 3.0.5 before 3.4.0, and the advisory rates severity as low.

## Why it matters

Only deployments that run the example Dag and handle HTTP-fetched IPv6 addresses are at risk, but the flaw shows how unvalidated input can reach a shell command even after an IP check.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later.
- Check whether the example_dag_decorator example Dag is deployed in your environment.

## Versions

- Apache Airflow 3.0.5
- Apache Airflow 3.4.0

## CVEs

- CVE-2026-101031

## Timeline

- 2026-11-08: Vulnerability posted to oss-sec by Rahul Vats

## Coverage

- [CVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier](https://seclists.org/oss-sec/2026/q4/591) — Open Source Security, 2026-11-09

Tags: apache-airflow, security, shell-injection, cve, python, ipv6

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev