CVE-2026-86843: Apache Airflow Teradata Provider SQLi Flaw

CVE-2026-86843 Overview

CVE-2026-86843 affects the Apache Airflow Teradata provider's compute-cluster example DAG. The example DAG declared every DAG Param as unconstrained free text and templated those values directly into compute-cluster operators that interpolate into Teradata Data Definition Language (DDL). A user permitted to trigger the DAG, but lacking Teradata credentials, could supply SQL fragments that execute under the connection the task runs as. The same free-text connection_id Param also lets that user redirect the task to any other connection defined in the deployment. Only deployments running this example DAG, or a DAG copied from it, are affected. The provider's operator code itself is unchanged. This weakness is tracked as [CWE-89: SQL Injection].

Critical Impact
A lower-trust Airflow user who can trigger the example DAG can execute arbitrary SQL against any Teradata connection defined in the deployment.

Affected Products

Apache Airflow Teradata provider (apache-airflow-providers-teradata) versions prior to 3.7.0
Deployments running the compute-cluster example DAG shipped by the provider
Any user-authored DAG copied from the vulnerable example

Discovery Timeline

2026-09-29 - CVE-2026-86843 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-86843

Vulnerability Analysis

The compute-cluster example DAG exposes every runtime input as a free-text Airflow Param. Those Params are then rendered through Jinja templating into operator fields that Teradata treats as DDL. Because no validation is applied at trigger time, an operator with the can_trigger permission can inject SQL fragments that concatenate into statements executed by the worker. The task connects using credentials the trigger-user does not otherwise possess, resulting in privilege escalation across the Airflow trust boundary.

A second issue compounds the injection. The connection identifier is itself a free-text Param, so the triggering user can point the task at any Teradata (or otherwise compatible) connection defined in the deployment. An attacker can therefore choose the most privileged connection available and execute their injected SQL against that target.

Root Cause

The root cause is missing input constraint on DAG Params combined with direct template interpolation into DDL strings. The example DAG did not restrict Params to validated identifiers or a closed value set, and it treated conn_id as an arbitrary string rather than a fixed configuration value.

Attack Vector

Exploitation requires an authenticated Airflow user with permission to trigger the vulnerable DAG. The attacker supplies malicious values through the trigger form: SQL fragments in identifier Params, and an alternate conn_id value to redirect execution. The worker renders the template, submits the statement to Teradata using stored credentials, and returns the results through task logs. No Teradata credentials are required from the attacker.

No verified public exploit code is available. See the GitHub Pull Request for Airflow and the Apache Mailing List Discussion for technical details of the fix.

Detection Methods for CVE-2026-86843

Indicators of Compromise

Airflow task logs showing rendered compute-cluster operator fields that contain SQL metacharacters such as semicolons, comment markers, or nested statements
DAG-run records where the conn_id Param differs from the connection expected by the example DAG author
Teradata audit logs recording DDL statements from Airflow service accounts that do not match the compute-cluster operator's expected pattern

Detection Strategies

Enumerate installed DAGs and flag any that import from airflow.providers.teradata.example_dags or contain the compute-cluster example structure
Inspect DAG source for Params typed as unconstrained string that flow into operator arguments templated into SQL
Correlate Airflow dag_run.conf history with Teradata query logs to identify user-supplied SQL fragments

Monitoring Recommendations

Alert on Airflow DAG triggers where Params contain SQL keywords such as DROP, GRANT, UNION, or --
Monitor Teradata connections used by Airflow for unexpected DDL activity or schema changes
Track use of the can_trigger role against DAGs that interact with production Teradata connections

How to Mitigate CVE-2026-86843

Immediate Actions Required

Upgrade apache-airflow-providers-teradata to version 3.7.0 or later
Audit all deployed DAGs for code copied from the compute-cluster example and apply the same constraints to those copies
Restrict the Airflow can_trigger permission on any DAG that interacts with Teradata connections until remediation is verified
Review Teradata audit logs for suspicious DDL activity originating from Airflow service accounts

Patch Information

The fix ships in apache-airflow-providers-teradata 3.7.0. The updated example constrains Params to validated identifiers and a closed value set, and it removes connection selection and free-form option strings from trigger-time input. Upgrading the provider does not modify DAGs already copied from the vulnerable example; those copies must be updated manually. See the GitHub Pull Request for Airflow and the Openwall OSS Security Update for full disclosure details.

Workarounds

Remove or disable the compute-cluster example DAG from production deployments
Replace free-text DAG Params with enum or regex-validated string types that reject SQL metacharacters
Hard-code the conn_id inside the DAG rather than exposing it as a triggerable Param
Apply least-privilege on the Teradata connection so Airflow workers cannot execute privileged DDL

bash

# Upgrade the Teradata provider to the patched version
pip install --upgrade 'apache-airflow-providers-teradata>=3.7.0'

# Verify installed version
pip show apache-airflow-providers-teradata | grep -i version