A vulnerability labeled as critical has been found in Apache Airflow up to 3.1.x. Affected is an unknown function of the file dag_run.conf of the component BashOperator. Executing a manipulation can lead to injection.
This vulnerability is registered as CVE-2026-30898. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
