CVE-2026-67587

Analyzed Analyzed - Analysis Complete

Arbitrary Code Execution in Apache Airflow Scheduler

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: Apache Software Foundation

Description

Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-67587

EUVD

EUVD-2026-57274

Affected Vendors & Products

Vendor	Product	Version / Range
apache	airflow	From 3.3.0 (inc) to 3.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Airflow allows a DAG author to trigger arbitrary module imports in the scheduler process by manipulating serialized callback data. The scheduler's timeout sweep deserializes task instance data, and a crafted next_kwargs value can force the scheduler to import any module during this process. This occurs because the Callback object rebuilds from serialized data by re-running its constructor, which imports the module specified in the callback path.

Detection Guidance

Detecting this vulnerability requires checking Apache Airflow versions and monitoring for unusual module imports in scheduler logs. Verify if your Airflow version is below 3.3.0. Check scheduler logs for unexpected module imports during deserialization processes.

Impact Analysis

An attacker with task execution API access could exploit this to execute arbitrary code in the scheduler process. This could lead to data breaches, system compromise, or disruption of Airflow operations. The impact depends on the scheduler's privileges and the modules imported.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized code execution, potentially leading to data exposure or system tampering. Organizations using Airflow must address this to maintain data protection standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.1 or later immediately. No configuration changes can mitigate this issue; the fix is only available through upgrading. Review scheduler logs for signs of exploitation before upgrading.

Hi! I’m here to help you understand CVE-2026-67587. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70