CVE-2026-86843— Airflow Teradata插件SQL注入漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Airflow Teradata provider
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Apache Airflow Teradata 提供商中的计算集群示例 DAG 将所有 DAG 参数均声明为不受约束的自由文本，并直接将这些参数模板化地传入计算集群操作符。这些操作符会将这些值插值到 Teradata DDL 语句中。因此，任何有权触发该 DAG 的用户（其信任级别低于 DAG 作者，且无需拥有自身的 Teradata 凭据）均可提供 SQL 片段，这些片段将以任务运行时的连接身份执行。此外，由于连接 ID 本身也是一个自由文本参数，用户还可以将任务重定向到部署环境中定义的任何其他连接。只有运行此示
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-86843 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag
来源: CVE Program / CVE List V5
Vulnerability Description
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a lower-trust role than the Dag author, and one that needs no Teradata credentials of its own - could therefore supply SQL fragments that execute under the connection the task runs as, and could additionally redirect the task at any other connection defined in the deployment, because the connection id was itself a free-text Param. Only deployments that run this example Dag, or a Dag copied from it, are affected; the provider's operator code is unchanged. Users of apache-airflow-providers-teradata are recommended to upgrade to version 3.7.0 or later, whose example constrains the Params to validated identifiers and a closed value set and removes connection selection and free-form option strings from trigger-time input. Upgrading does not change a Dag already copied from the example; users who copied it should apply the same constraints to their copy.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow Teradata provider | 0 ~ 3.7.0 | - |
|
二、漏洞 CVE-2026-86843 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-86843 的情报信息
请登录查看更多情报信息。
CVE-2026-86843 其他参考 (2)
-
https://lists.apache.org/thread/js9pmhj1j6552gpn1j8wdz579pb46t0d vendor-advisory
同批安全公告 · Apache Software Foundation · 2026-09-29 · 共 18 条
| CVE-2026-102496 | Apache XMLSchema: Denial of service through deeply nested schema structures | |
| CVE-2026-91012 | Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalatio | |
| CVE-2026-91048 | Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege esc | |
| CVE-2026-91085 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin | |
| CVE-2026-92142 | Apache Karaf: Authorization bypass in JMX MBean lifecycle operations | |
| CVE-2026-81914 | Apache Airflow Google provider 查询注入漏洞 | |
| CVE-2026-81862 | Airflow Teradata插件云存储凭据泄露漏洞 | |
| CVE-2026-81930 | Apache Airflow Snowflake provider 令牌重定向漏洞 | |
| CVE-2026-102495 | Apache XMLSchema: Denial of service through unbounded recursion when resolving schema impo | |
| CVE-2026-71897 | Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and ba | |
| CVE-2026-102497 | Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker | |
| CVE-2026-66083 | Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasourc | |
| CVE-2026-82804 | Apache DolphinScheduler 告警脚本命令注入漏洞 | |
| CVE-2026-81569 | Apache DolphinScheduler 子任务工作流未授权执行漏洞 | |
| CVE-2026-78214 | Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths | |
| CVE-2026-71899 | Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to | |
| CVE-2026-71898 | Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-71897
Apache DolphinScheduler: Allows unauthorized workflow operat -
CVE-2026-71898
Apache DolphinScheduler: Improper Authorization Allows Proje -
CVE-2026-71899
Apache DolphinScheduler: Missing Authorization in query-dyna -
CVE-2026-78214
Apache DolphinScheduler: Actuator Endpoint Authentication By -
CVE-2026-81569
Apache DolphinScheduler 子任务工作流未授权执行漏洞
V. Comments for CVE-2026-86843
暂无评论