Apache Airflow Task SDK Code Execution Vulnerability

CVE-2026-67587

What is CVE-2026-67587?

The Task SDK of Apache Airflow allows for the reconstruction of Callback objects from serialized data, which subsequently may lead to arbitrary module imports during the deserialization process. This issue originates when a Dag author manipulates a task instance's next_kwargs through the execution API, which can trigger harmful imports in the scheduler process. Notably, earlier versions prior to 3.3.0 are not impacted, as the relevant scheduler sweep did not exist at that time. Users should ensure they upgrade to Apache Airflow version 3.3.1 or later to mitigate this vulnerability.

References