A flaw in the SSHRemoteJobOperator of Apache Airflow’s SSH provider allows shell syntax within the templated `environment` parameter to be executed on the remote host. Because the operator only quotes the values once, expressions like `$(…)` or backticks are processed by the remote shell. This permits an attacker who can trigger a DAG but does not have permission to modify the DAG code to run arbitrary commands as the SSH user, effectively compromising the remote system.

The issue exists in all releases of the Apache Airflow SSH provider before version 7.0.1. Any deployment that uses a pre‑7.0.1 provider and accepts user‑supplied `environment` values at trigger time is affected.

The vulnerability results in remote code execution, a very high‑severity impact. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is user trigger of a DAG that passes unsanitized values into `environment`; the attacker does not need to modify DAG code, only trigger permission. Because the flaw involves execution of shell commands on a remote host, the exploit would allow full lateral movement or system compromise if the SSH user is privileged.