---
id: CVE-2022-38362
aliases:
  - GHSA-746v-hfh2-xphm
  - PYSEC-2026-773
title: Remote code execution in Apache Airflow Docker's Provider
summary: Remote code execution in Apache Airflow Docker's Provider
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: apache-airflow-providers-docker
product: apache-airflow-providers-docker
ecosystem: pip
affected:
  - apache-airflow-providers-docker < 3.0.0
patched:
  - apache-airflow-providers-docker 3.0.0
published: '2022-08-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-746v-hfh2-xphm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-38362'
  - url: 'https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb'
  - url: 'http://www.openwall.com/lists/oss-security/2022/08/16/1'
tags:
  - osv
  - pip
epss: 0.01857
epssPercentile: 0.78296
ingestedAt: '2026-07-08T18:25:46.753Z'
---

## Overview

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above.

## Affected packages

- `apache-airflow-providers-docker < 3.0.0`

## Remediation

Upgrade to a patched release:

- `apache-airflow-providers-docker 3.0.0`