EUVD-2026-57275
GHSA-q4c3-7575-55j2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
DAG author API access is network-reachable (AV:N) with no special conditions (AC:L); authenticated low-privilege role required (PR:L); payload executes inside the separate scheduler process causing scope change (S:C); full C/I/A impact on the scheduler.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionCVE.org
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaiting_input task state swept by the scheduler. That sweep deserializes the task instance's next_kwargs without an allow-list, so a Dag author - who controls that value through the task execution API - can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default allowed_deserialization_classes setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere - deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Articles & Coverage 2
AnalysisAI
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of task instance next_kwargs during the scheduler's unconditional awaiting_input sweep, a code path introduced as part of the 3.3.0 human-in-the-loop task rewrite. Any authenticated DAG author who can influence task state through the task execution API can supply a crafted payload that causes arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a DAG author role or equivalent permission to submit or influence task state via the Airflow task execution API in the targeted deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite the absence of a formal CVSS score in the advisory, the exploitability profile is severe: the scheduler sweep runs unconditionally every 15 seconds with no configuration required, and the `next_kwargs` field is directly controllable by any authenticated DAG author through the task execution API - a role present in virtually every Airflow deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated DAG author submits a task to the Airflow task execution API with `next_kwargs` containing a reference to an arbitrary Python class outside the platform's normal serialization allow-list. Within 15 seconds, the scheduler's `awaiting_input` sweep picks up the task instance, deserializes the payload without restriction inside the scheduler process, and imports and instantiates the attacker-specified object at the scheduler's OS privilege level - enabling arbitrary command execution or crashing the scheduler and halting all pipeline orchestration. … |
| Remediation | Vendor-released patch: apache-airflow 3.3.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether any Apache Airflow 3.3.0 instances are running in production and restrict DAG authorship privileges to trusted administrators only pending patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today