PYSEC-2026-773
Remote code execution in Apache Airflow Docker's Provider
At a glance
- Published
- Updated
- CVE
- CVE-2022-38362
- Aliases
- GHSA-746v-hfh2-xphm
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow-providers-docker | introduced 0, fixed 3.0.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-38362 ADVISORY
- https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb WEB
- http://www.openwall.com/lists/oss-security/2022/08/16/1 WEB
- https://pypi.org/project/apache-airflow-providers-docker PACKAGE
- https://github.com/advisories/GHSA-746v-hfh2-xphm ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |