Apache Airflow
CVE-2026-68982
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to Celery message broker
-
ExploitCraft forged callback workload
-
ExecutionWorker omits workload-token validation
-
ImpactExecute attacker-controlled code on worker
Vulnerability Assessment
| Exploitation Conditions | Applies specifically to Apache Airflow deployments using the CeleryExecutor (not LocalExecutor or KubernetesExecutor). The core precondition is the ability to deliver a forged callback workload to a Celery worker - i.e. the capacity to enqueue messages to the Celery broker (Redis/RabbitMQ) consumed by workers; the missing workload-token validation means no valid scheduler-issued token is needed for the forged workload to run. Limiting factors: exploitation is bounded to CeleryExecutor environments and by whatever access control protects the broker/message queue; it is not described as default remote-unauthenticated exploitation of the Airflow web interface. The exact trigger path and the precise authentication level required are not described in the available sources and should be verified against the vendor advisory. |
| Impact | Signal coverage for this CVE is sparse: the input provides no CVSS score or vector, no CWE, no EPSS probability, no KEV listing, and no PoC/exploit reference - only a single oss-security advisory and a vuln.today Decision label of 'awaiting_data', which itself indicates the triage pipeline considers the data incomplete rather than actionable. On mechanism alone the flaw is serious: in Apache Airflow's CeleryExecutor, callback workloads are dispatched to Celery workers without validating the workload token that is supposed to prove a workload originated from the scheduler, so a forged callback workload is executed by the worker - an authentication/trust-validation bypass that can lead to code execution in the worker context. However, this is NOT clearly a remote-unauthenticated-against-default-web-UI issue: exploitation presupposes the ability to deliver a forged callback workload to the worker's queue (i.e. access to the Celery message broker), and it only affects deployments using the CeleryExecutor. Because no CVSS vector is supplied I cannot confirm attack vector, complexity, or authentication requirements from the input, and the exact trigger path is not described in the available sources - so the real-world priority should be treated as 'potentially high impact, preconditions-gated' and verified against the vendor advisory before being ranked alongside confirmed network-exploitable criticals. Key missing/conflicting data stated explicitly: no CVSS vector provided (severity and auth cannot be confirmed), no EPSS, no KEV, no PoC reference, and no fixed versions in the available excerpt. |
| Exploit ScenarioDerived | An attacker who can place messages onto the Celery broker used by an Airflow CeleryExecutor deployment crafts a forged callback workload. Because the worker does not validate the workload token before running it, the worker executes the attacker-supplied workload, resulting in code execution in the worker's context. No public exploit was identified at time of analysis; the exact trigger path is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 09, 2026
Forged callback workloads pushed onto the Celery broker are executed by Apache Airflow CeleryExecutor workers without validation of a workload token, so whoever can enqueue messages to the broker (Redis or RabbitMQ) consumed by those workers can make them run attacker-supplied work under the worker's privileges. Exposure is confined to Airflow deployments using CeleryExecutor rather than LocalExecutor or KubernetesExecutor, and the practical barrier is whatever access control protects the broker and message queue; the assessment records an impact of high confidentiality, integrity and availability with a low-privilege authenticated vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), although the precise trigger path and required authentication level are not described in the available sources. Intelligence coverage is thin - no CVSS or CWE from the CVE record itself, no EPSS probability, no KEV listing and no exploit reference - and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis, so the exact fixed version must be taken from the Apache Airflow project's own advisory rather than assumed; consult the oss-security thread at https://seclists.org/oss-sec/2026/q4/585 and the corresponding Airflow security page for the release that introduces workload-token validation on Celery workers. Until that is confirmed, the exposure is bounded by control of the Celery broker: restrict network reachability to Redis or RabbitMQ and enforce broker authentication and ACLs so only the Airflow scheduler and other trusted components can publish to the queues the workers consume, with the trade-off that tightening broker ACLs and credentials can break legitimate task dispatch and requires coordinated rollout across schedulers, workers and any external submitters. Organisations able to change topology can move affected DAGs to LocalExecutor or KubernetesExecutor, which the advisory does not describe as vulnerable, accepting the loss of Celery's distributed scaling model. Because the triage signal for this CVE is incomplete (Decision label 'awaiting_data', no EPSS, no KEV, no published exploit reference), treat the lack of confirmed exploitation as an absence of data rather than a guarantee, and verify prerequisites against the vendor advisory before deciding urgency.
Affected ProductsAI
Apache Airflow deployments configured to use the CeleryExecutor, where Celery workers consume workloads from a Redis or RabbitMQ broker; LocalExecutor and KubernetesExecutor deployments are not described as affected. No CPE identifiers and no specific version ranges are supplied in the available input, and the single reference is the oss-security posting at https://seclists.org/oss-sec/2026/q4/585, which should be read together with the Apache Airflow vendor advisory to establish the precise affected release branches before scoping an inventory.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Airflow's CeleryExecutor distributes task execution by having the scheduler place work onto a Celery message broker, from which distributed Celery workers pull and run it; the security of that model depends on workers being able to tell scheduler-authorised work apart from anything else that reaches the queue. According to the oss-security advisory, the workers do not validate the workload token attached to callback workloads, so a forged workload injected into the broker is accepted and executed just like legitimate scheduler-dispatched work. No CWE identifier is assigned in the available data, and the sources do not describe the exact code path or message format involved, so the root-cause classification should be confirmed against the vendor advisory; the weakness is best understood as missing authenticity verification on a trust boundary between the scheduler and its workers. Only the CeleryExecutor topology is implicated - the Celery broker and its worker fleet constitute the attack surface, not the Airflow web interface directly - and the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network reachability combined with a low-privilege precondition rather than unauthenticated exploitation of the UI.
Know when SSH gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Forging callback workloads requires reaching the Celery broker (PR:L, AV:N) but no token (AC:L); missing validation yields worker code execution, so C/I/A:H; scope kept U as uncertain, no UI.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
GitHub PoC
Exploit-DB