CVE-2025-54941: 
Apache Airflow vulnerability analysis and mitigation

CVE-2025-54941 is a command injection vulnerability in Apache Airflow's example_dag_decorator example DAG. The flaw allows an authenticated UI user to supply a non-validated parameter that redirects the example DAG to a malicious server, resulting in arbitrary code execution on the Airflow worker. It affects Apache Airflow versions 3.0.0 through 3.0.4 (i.e., >= 3.0.0, < 3.0.5). The vulnerability was disclosed on October 29–30, 2025, with a patch released in Airflow 3.0.5. It carries a CVSS v3.1 base score of 4.6 (Medium) and a CVSS v4.0 score of 5.2 (Moderate) (GitHub Advisory, Openwall OSS-Sec).

The root cause is improper neutralization of special elements used in an OS command (CWE-78), specifically within the example_dag_decorator example DAG shipped with Apache Airflow. The DAG accepts a user-supplied parameter without validation, which can be manipulated to point to an attacker-controlled server; when the DAG executes, it fetches from or interacts with that server in a way that results in OS command execution on the worker node. Exploitation requires either that example DAGs are enabled in the production Airflow environment (disabled by default) or that a user has copied the vulnerable example DAG code into their own custom DAG. The vulnerability was reported by a researcher identified as "Nacl" (Openwall OSS-Sec, GitHub Advisory).

Successful exploitation allows an authenticated Airflow UI user to execute arbitrary code on the Airflow worker node, potentially leading to unauthorized system access, data theft, or further lateral movement within the infrastructure. The CVSS v4.0 assessment rates confidentiality, integrity, and availability impacts on the vulnerable system as High, reflecting the severity of worker-level code execution. However, the scope is limited to the worker node itself, with no assessed impact on subsequent systems (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.03–0.18%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for low-privilege authenticated access to the Airflow UI and the non-default configuration of enabling example DAGs in production (Openwall OSS-Sec).

1. Prerequisite check: Confirm that the target Apache Airflow instance (versions 3.0.0–3.0.4) has example DAGs enabled in production (load_examples = True in airflow.cfg), or identify a custom DAG derived from example_dag_decorator.
2. Authenticate to the Airflow UI: Log in with any low-privilege user account that has access to trigger or configure DAGs.
3. Locate the vulnerable DAG: Navigate to the example_dag_decorator DAG in the Airflow UI.
4. Inject malicious parameter: Supply a crafted, non-validated parameter value pointing to an attacker-controlled server (e.g., a URL or hostname containing OS command injection payloads) when triggering or configuring the DAG run.
5. Trigger DAG execution: Initiate a DAG run; the worker processes the unvalidated parameter, connects to the malicious server, and executes attacker-controlled code on the worker node.
6. Achieve code execution: The injected command runs in the context of the Airflow worker process, enabling data exfiltration, reverse shell establishment, or further compromise (Openwall OSS-Sec, GitHub Advisory).

• Logs: Airflow task logs showing unexpected outbound connections or unusual command output from example_dag_decorator DAG runs; Airflow scheduler/worker logs with errors or anomalous subprocess activity.
• Network: Outbound connections from Airflow worker nodes to unknown or external IP addresses/hostnames not associated with normal DAG operations, particularly during example_dag_decorator task execution.
• Process: Unexpected child processes spawned by the Airflow worker process (e.g., bash, sh, curl, wget, python) with unusual arguments or parent-child relationships.
• Configuration: load_examples = True present in airflow.cfg on a production instance, indicating example DAGs are enabled.

Upgrade Apache Airflow to version 3.0.5 or later, which contains the fix for the unvalidated parameter in example_dag_decorator (GitHub Advisory). As an immediate workaround, ensure example DAGs are disabled in production by setting load_examples = False in airflow.cfg (this is the default). Organizations that have copied example_dag_decorator code into custom DAGs should review and update those DAGs to apply the input validation changes introduced in Airflow 3.0.5. Additionally, implement strict access controls on the Airflow UI to limit which users can trigger or configure DAGs (Openwall OSS-Sec).

The vulnerability was disclosed by Kaxil Naik via the Apache security process and announced to the oss-security mailing list on October 29, 2025, with credit given to the reporter "Nacl" (Openwall OSS-Sec). The GitHub Advisory Database rated it as "Moderate" severity. Social media activity was limited, with a brief mention on Bluesky shortly after disclosure. Overall community reaction has been muted, consistent with the low exploitation risk due to the non-default configuration requirement.