EUVD-2026-57274
GHSA-2qjv-p2gc-mjg2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible API requires only DAG author credentials (PR:L); unconditional scheduler sweep means no complexity; full scheduler process impact yields C/I/A:H with no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionCVE.org
Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default allowed_deserialization_classes allow-list, so tightening that setting does not help. A Dag author - who controls a task instance's next_kwargs through the task execution API - can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's awaiting_input timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization - applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Articles & Coverage 2
AnalysisAI
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module imports inside the scheduler process. By controlling a task instance's next_kwargs via the task execution API, an attacker can inject a crafted callback path that the scheduler's unconditional awaiting_input timeout sweep deserializes by re-running the SyncCallback constructor - triggering an import of the named module in the scheduler's process space. Because SyncCallback is itself an Airflow class, it bypasses the allowed_deserialization_classes allow-list, making tightening that setting ineffective. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 reflects the severity of the potential scheduler process compromise.
Technical ContextAI
The vulnerability resides in task-sdk/src/airflow/sdk/definitions/callback.py, specifically in how SyncCallback and AsyncCallback are rebuilt from serialized storage. The get_callback_path method, when processing a plain str path, calls importlib.import_module on the module component of the dot-separated path as a side effect. During normal DAG authoring this is intentional - it validates the path. However, when the scheduler's awaiting_input timeout sweep deserializes stored Callback objects by calling the constructor anew, this same import fires against attacker-controlled data from the database. Because SyncCallback is in Airflow's own namespace, it passes the allowed_deserialization_classes allow-list check (CWE-502: Deserialization of Untrusted Data), rendering that control ineffective. The fix (PR #70704) introduces a _SerializedCallbackPath marker subclass of str that short-circuits get_callback_path to return the stored path without triggering an import, separating the 'create and validate' code path from the 'reconstruct from storage' code path. Affected CPE: cpe:2.3:a:apache_software_foundation:apache_airflow:3.3.0.
RemediationAI
The primary fix is to upgrade to Apache Airflow 3.3.1 or later, as explicitly advised by the Apache Software Foundation. The upstream patch is available in GitHub PR #70704 (https://github.com/apache/airflow/pull/70704). No workaround involving allowed_deserialization_classes is effective, as confirmed by the CVE description - tightening this setting does not prevent the exploitation path because SyncCallback passes the allow-list by design. If an immediate upgrade is not possible, a compensating control is to restrict DAG authoring permissions to fully trusted internal users only, eliminating the low-privilege attacker precondition; however, this is an access-control mitigation and does not fix the underlying flaw. Applying patches for the related CVE-2026-58076 or CVE-2026-67260 does not address this vulnerability, as they cover distinct deserialization gadgets. The vendor advisory at https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0 should be consulted for the latest guidance.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
Unsafe XCom templating in Apache Airflow's documented example DAG (`example_xcom.py`) allowed an authenticated UI user w
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today