Deserialization of Untrusted Data in Apache Airflow - CVE-2026-67260
Published: August 24, 2026
Vulnerability identifier: #VU144876
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67260
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to unsafe deserialization in the scheduler awaiting_input task-state sweep when deserializing task instance next_kwargs. A remote user can control that value through the task execution API to execute arbitrary code.
The issue can also terminate the scheduler job. The vulnerable code path runs unconditionally every 15 seconds and is reached by human-in-the-loop tasks in the awaiting_input state.
Affected software
Apache Airflow
How to mitigate CVE-2026-67260
Install security update from vendor's website.
Apache Airflow - update to 3.3.1