{"id":"CVE-2026-101031","aliases":["EUVD-2026-119897","GHSA-423g-74fv-rrcc"],"status":"published","title":"Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier","description":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-11-09T09:44:39Z","modified":"2026-11-09T12:31:39Z","products":[{"vendor":"apache software foundation","product":"apache airflow"}],"references":[{"url":"https://github.com/apache/airflow/pull/73787","tags":["patch"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54941","tags":["related"]},{"url":"https://lists.apache.org/thread.html/p53zxybld58wv722c7zxk0w8d2rnkfwk","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101031"},{"url":"https://github.com/advisories/GHSA-423g-74fv-rrcc"}],"sources":{"cve":[{"id":"CVE-2026-101031","title":"Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier","description":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.","status":"published","published":"2026-11-09T09:44:39.236Z","modified":"2026-11-09T09:44:39.236Z","cwes":["CWE-78"],"updated_at":"2026-11-09T10:32:46.549431Z"}],"euvd":[{"id":"EUVD-2026-119897","description":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.","status":"published","published":"2026-11-09T09:44:39Z","modified":"2026-11-09T09:44:39Z","updated_at":"2026-11-09T15:17:15.365583Z"}],"ghsa":[{"id":"GHSA-423g-74fv-rrcc","title":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address...","description":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.","status":"published","published":"2026-11-09T12:31:38Z","modified":"2026-11-09T12:31:39Z","cwes":["CWE-78"],"updated_at":"2026-11-09T12:48:04.148562Z"}],"nvd":[{"id":"CVE-2026-101031","description":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production.","status":"published","published":"2026-11-09T10:17:02.313Z","modified":"2026-11-09T10:17:02.313Z","cwes":["CWE-78"],"updated_at":"2026-11-09T12:13:58.438772Z"}]}}