CVE-2022-40127

This repository provides a functional proof-of-concept for CVE-2022-40127, demonstrating RCE in Apache Airflow < 2.4.0 via command injection in the `example_bash_operator` DAG. It includes Docker setup instructions and two PoC methods: one via DAG configuration and another via API endpoint exploitation.

This repository contains a functional exploit for CVE-2022-40127, an RCE vulnerability in Apache Airflow versions prior to 2.4.0. The exploit leverages the `example_bash_operator` DAG to execute arbitrary commands via a crafted `run_id` parameter, demonstrating a reverse shell payload.