EUVD-2026-57274
GHSA-2qjv-p2gc-mjg2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible API requires only DAG author credentials (PR:L); unconditional scheduler sweep means no complexity; full scheduler process impact yields C/I/A:H with no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionCVE.org
Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default allowed_deserialization_classes allow-list, so tightening that setting does not help. A Dag author - who controls a task instance's next_kwargs through the task execution API - can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's awaiting_input timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization - applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Articles & Coverage 2
AnalysisAI
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module imports inside the scheduler process. By controlling a task instance's next_kwargs via the task execution API, an attacker can inject a crafted callback path that the scheduler's unconditional awaiting_input timeout sweep deserializes by re-running the SyncCallback constructor - triggering an import of the named module in the scheduler's process space. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user account with DAG authoring privileges and the ability to interact with the task execution API to set a task instance's `next_kwargs` field to a crafted value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is credible and consistent with the description: network-accessible task execution API, low attack complexity once the attacker has DAG author credentials, and full confidentiality/integrity/availability impact on the scheduler process if an arbitrary module is imported. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or insider-threat DAG author authenticates to an Apache Airflow 3.3.0 deployment and submits a task instance whose `next_kwargs` contains a crafted `SyncCallback` path pointing to an attacker-controlled module on a filesystem path accessible to the scheduler process - or to a legitimate module with dangerous import-time side effects. When the scheduler's `awaiting_input` timeout sweep runs unconditionally and deserializes the stored `Callback` object, it re-invokes the constructor and imports the named module inside the scheduler process, achieving code execution with the scheduler's operating system privileges. … |
| Remediation | The primary fix is to upgrade to Apache Airflow 3.3.1 or later, as explicitly advised by the Apache Software Foundation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all users with DAG authorship permissions and categorize by access scope and trustworthiness; implement temporary restrictions on DAG deployments from high-risk accounts until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today