APScheduler CVE-2026-31072

Exploitation requires that the target application actively deserializes attacker-reachable input through APScheduler's JSONSerializer or CBORSerializer - typically a job store, broker, or HTTP/queue endpoint that accepts JSON or CBOR payloads from an untrusted boundary and passes them into unmarshal_object. No authentication or user interaction is needed at the serializer itself (CVSS PR:N/UI:N), but the limiting factor is application-level: APScheduler does not expose a network listener on its own, so vulnerability is contingent on the embedding application surfacing the serializer to remote input. Exploitation also requires that suitable gadget classes (with exploitable __setstate__ behavior) are importable in the target Python environment, which is generally true for production deployments that include common stdlib or third-party modules.

CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H signals network-reachable, unauthenticated, low-complexity exploitation yielding full CIA loss - consistent with a serializer-side RCE primitive. Public POC availability (the linked gist) raises practical risk, yet EPSS sits at only 0.06% (19th percentile) and the vulnerability is not in CISA KEV, indicating it is not yet seeing broad opportunistic exploitation. The realistic threat is gated by whether a deployed application actually accepts external JSON/CBOR APScheduler payloads, which APScheduler itself does not expose by default - the CPE is unspecified (n/a) and EUVD lists 'n/a n/a' for affected versions, so the practical blast radius depends heavily on downstream integrators. Net: treat as high priority for any service known to pass untrusted input into APScheduler's serializers, but lower priority for internal-only schedulers that only deserialize trusted job stores.

An attacker identifies a web service that reads scheduled-job payloads from an exposed queue, webhook, or REST endpoint and hands them to APScheduler's JSONSerializer or CBORSerializer. They submit a crafted payload referencing a Python class whose __setstate__ has side effects (for example a subprocess or os-module gadget) with attacker-controlled state, and unmarshal_object imports the module, instantiates the class, and triggers code execution in the worker process; the published gist at gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6 provides working payload construction.