GHSA-746v-hfh2-xphm

Remote code execution in Apache Airflow Docker's Provider

At a glance

Published: 2022-08-17 00:00 UTC
Updated: 2026-07-07 11:56 UTC
CVE: CVE-2022-38362
Aliases: PYSEC-2026-773
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above.

Affected packages

Package	Versions
PyPI · apache-airflow-providers-docker	introduced 0, fixed 3.0.0

References

https://nvd.nist.gov/vuln/detail/CVE-2022-38362 ADVISORY
https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb WEB
http://www.openwall.com/lists/oss-security/2022/08/16/1 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database