External risk intelligence

Apache Airflow Example DAGs Allow Shell Command Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-101031

This vulnerability affects example code (example_dag_decorator) that is not intended for production use. Apache Airflow documentation explicitly recommends disabling example DAGs (load_examples = False) in production environments. Because the vulnerable code is a non-production artifact and requires specific, non-default configuration to be enabled, it is not a public-facing deployment.

OS Command Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Apache Airflow's example code that could allow an attacker to inject commands into a worker's shell if specific example DAGs are loaded and triggered with a custom URL. While the affected code is not intended for production, it represents an incomplete fix for a previous vulnerability and requires attention if example DAGs are enabled.

Example code allows command injection if enabled.
It's a repeat fix; re-check previous remediation.
Confirm relevance if example Dags are active.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to a vulnerable Apache Airflow instance. This request would target the `example_dag_decorator` example DAG, which is loaded when the `load_examples` setting is enabled. By manipulating the `url` parameter within this request, the attacker can inject malicious shell commands that will be executed on the Airflow worker. This vulnerability is a partial fix for a previous issue.

Requires example DAGs to be enabled.
Triggered by a custom URL parameter.
Allows remote command injection.

Live Threat

Current exploitation, exposure, and threat context

When example DAGs are loaded and a user can trigger a DAG with a custom URL parameter, it could lead to shell commands being injected and executed on the worker. This occurs because the system improperly validates an IP address fetched over HTTP, allowing for arbitrary characters in the input to be placed into a shell command.

Worker execution environment.
Loading example DAGs with custom URL.
Remote code execution on workers.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Apache Airflow platform owners and security teams are most likely responsible for addressing this vulnerability. The immediate first step is to identify all Airflow instances, confirm if example DAGs are enabled, and determine if these instances are exposed or critical. This will allow for an informed decision on remediation or mitigation strategies, such as upgrading Airflow or disabling example DAGs.

Airflow platform and security teams own remediation.
Verify example DAGs enabled and production impact.
Upgrade Airflow or disable example DAGs.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Airflow and why does it include example DAGs?

Apache Airflow is a platform used to programmatically author, schedule, and monitor workflows. It ships with example Directed Acyclic Graphs (DAGs) to help developers learn how to write and configure their own data pipelines. These example files are demonstration tools and are not intended to be used in production environments.

What is the vulnerability class for CVE-2026-101031?

This vulnerability is classified as CWE-78, which refers to OS Command Injection. In this instance, the flaw exists because the software takes user-supplied input—specifically a URL parameter—and improperly sanitizes it before passing it to a shell command. This allows an attacker to append their own malicious commands, which the system then executes with the same privileges as the Airflow worker process.

How can an attacker trigger this command injection?

An attacker must be able to trigger the specific example_dag_decorator DAG, which only happens if example DAGs are enabled in your configuration. The attack is triggered by providing a malicious URL parameter that bypasses standard IP validation. If example DAGs are disabled, or if an attacker cannot influence the DAG's parameters, this specific injection path does not function.

Is my environment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that risk is very unlikely for production deployments. Because the vulnerability is confined to example code that should never be enabled in production, it is generally not a public-facing risk. You should primarily check if you have intentionally enabled the non-default load_examples setting in your specific environment.

What steps should I take to address CVE-2026-101031?

Your first step is to verify if load_examples is set to True in your Airflow configuration. If it is enabled, you should immediately disable it, as this is the standard security recommendation for production. Alternatively, you can upgrade to Apache Airflow version 3.4.0 or later, which provides a more complete fix for the underlying input validation issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.