Serialization Key Vulnerability in Apache Airflow by Apache

CVE-2026-111395

What is CVE-2026-111395?

The vulnerability in Apache Airflow involves the improper handling of reserved serialization keys within a Dag run's 'conf'. When a user, authorized to trigger a Dag with a deadline alert featuring an asynchronous callback, submits a 'conf' that bypasses these keys, it can lead to system instability. Specifically, this can result in repeated crashes of the scheduler or the creation of problematic objects within the Triggerer. Users are strongly advised to transition to Apache Airflow version 3.4.0 or newer to mitigate this security risk.

References