Code Injection in Apache Airflow - CVE-2026-58076
Published: August 24, 2026
Vulnerability identifier: #VU144872
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58076
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in BaseSerialization.deserialize when deserializing exception nodes from a serialized Dag blob. A remote user can place a crafted value in executor_config to execute arbitrary code.
The code may run in the scheduler during normal Dag deserialization and in the API server when an authenticated read of the Dag occurs.
Affected software
Apache Airflow
How to mitigate CVE-2026-58076
Install security update from vendor's website.
Apache Airflow - update to 3.3.1