What is the CVSS score of CVE-2026-67260?

CVE-2026-67260 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Apache Airflow are affected by CVE-2026-67260?

Apache Airflow 3.3.0 contains a remote code execution vulnerability in the scheduler's task processing logic that allows authenticated DAG authors to execute arbitrary code within the scheduler…. A patch is available.

How to fix or mitigate CVE-2026-67260?

Within 24 hours, verify whether any Apache Airflow 3.3.0 instances are running in production and restrict DAG authorship privileges to trusted administrators only pending patching. Within 7 days, upgrade all affected Airflow 3.3.0 deployments to version 3.3.1 or later, following your standard change management procedures, and review scheduler audit logs from the past 30 days for evidence of exploitation. Within 30 days, implement formal access controls for DAG creation, conduct a security review of all existing DAGs for suspicious patterns, and establish ongoing monitoring for task state modifications via the task execution API.

Apache Airflow CVE-2026-67260

EUVD-2026-57275 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-12 apache

GHSA-q4c3-7575-55j2

Apache Deserialization Apache Airflow Apache Software Foundation

7.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

9.9 CRITICAL

DAG author API access is network-reachable (AV:N) with no special conditions (AC:L); authenticated low-privilege role required (PR:L); payload executes inside the separate scheduler process causing scope change (S:C); full C/I/A impact on the scheduler.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 16:10 vuln.today

Analysis Generated

Aug 12, 2026 - 16:10 vuln.today

CVE Published

Aug 12, 2026 - 15:33 cve.org

HIGH

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on apache-airflow (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.3.0.

DescriptionCVE.org

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaiting_input task state swept by the scheduler. That sweep deserializes the task instance's next_kwargs without an allow-list, so a Dag author - who controls that value through the task execution API - can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default allowed_deserialization_classes setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere - deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.

Articles & Coverage 2

News 6 New Apache Vulnerabilities - 6 High Severity, No POC Available Aug 13, 2026 News 8 New Apache Vulnerabilities - 8 High Severity, No Public Exploits Aug 12, 2026

AnalysisAI

Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of task instance next_kwargs during the scheduler's unconditional awaiting_input sweep, a code path introduced as part of the 3.3.0 human-in-the-loop task rewrite. Any authenticated DAG author who can influence task state through the task execution API can supply a crafted payload that causes arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job entirely. No public exploit has been identified at time of analysis, but a vendor-released patch exists in 3.3.1; deployments that previously patched CVE-2026-58076 are still vulnerable through this distinct code path and must upgrade.

Technical ContextAI

Apache Airflow 3.3.0 refactored human-in-the-loop (HIL) task handling by moving deferred tasks from the triggerer component to a new awaiting_input task state managed by the scheduler. The scheduler job runner's check_awaiting_input_timeouts method now sweeps this state every 15 seconds and passes each task instance's next_kwargs field to airflow.sdk.serde.deserialize, with a fallback to BaseSerialization.deserialize, without any class allow-list enforcement. This is the root of CWE-502 (Deserialization of Untrusted Data): the allowed_deserialization_classes configuration guard that protects other Airflow deserialization paths does not cover this sweep code path at all. DAG authors control the next_kwargs value through the task execution API, making the scheduler's own sweep process the attack surface. The GitHub PR #70685 fix introduces _decode_next_kwargs, a wrapper function that isolates deserialization failures and routes unresumable task instances to a controlled failure state rather than allowing the scheduler to process an unbounded or malicious payload. CPE cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:* with version range 3.3.0 to before 3.3.1 identifies the exact affected window; versions before 3.3.0 are explicitly not affected because HIL tasks used the triggerer code path, which does not share this deserialization gap.

RemediationAI

Vendor-released patch: apache-airflow 3.3.1. Upgrade to 3.3.1 or later as directed by the Apache Software Foundation advisory at https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn; the code fix is implemented in PR #70685 (https://github.com/apache/airflow/pull/70685). If an immediate upgrade is operationally blocked, restrict DAG authoring permissions to the minimum required set of fully trusted internal users, since a DAG author role is the prerequisite for supplying a malicious next_kwargs value. Blocking external access to the task execution API at the network perimeter reduces the attack surface to internal principals only, but does not eliminate the threat from insider or compromised accounts. Applying the patch for CVE-2026-58076 alone is explicitly insufficient - this is a distinct scheduler code path confirmed by the vendor advisory, and 3.3.1 is required to address both issues.