https://seclists.org/oss-sec/2026/q3/987: CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

Q: Are deployments affected merely by having the Teradata provider installed?

No. Only deployments that run the compute-cluster example Dag, or a Dag copied from that example, are affected. The provider's operator code is unchanged.

Q: What level of access does an attacker need?

An attacker needs permission to trigger the affected Dag. This can be a lower-trust role than the Dag author, and the attacker does not need Teradata credentials of their own.

Q: What could an attacker do through the affected Dag?

They could provide SQL fragments that execute under the Teradata connection used by the task. They could also redirect the task to another connection defined in the deployment because the connection ID was trigger-time input.

Q: Does upgrading fix Dags that were copied from the vulnerable example?

No. Upgrading to version 3.7.0 or later updates the example, but does not change a Dag that was already copied from it.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

pypi/apache-airflow-providers-teradata<3.7.0

Frequently Asked Questions

Are deployments affected merely by having the Teradata provider installed?

No. Only deployments that run the compute-cluster example Dag, or a Dag copied from that example, are affected. The provider's operator code is unchanged.

What level of access does an attacker need?

An attacker needs permission to trigger the affected Dag. This can be a lower-trust role than the Dag author, and the attacker does not need Teradata credentials of their own.

What could an attacker do through the affected Dag?

They could provide SQL fragments that execute under the Teradata connection used by the task. They could also redirect the task to another connection defined in the deployment because the connection ID was trigger-time input.

Does upgrading fix Dags that were copied from the vulnerable example?

No. Upgrading to version 3.7.0 or later updates the example, but does not change a Dag that was already copied from it.