Authentication Bypass Vulnerability in Apache Airflow's CeleryExecutor
CVE-2026-68982

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Airflow
Vendor
CVE Published:
9 November 2026

What is CVE-2026-68982?

An authentication bypass vulnerability in Apache Airflow's CeleryExecutor allows unauthorized users to enqueue malicious callback workloads. By exploiting this flaw, an attacker can run arbitrary code on connected CeleryExecutor workers without needing valid Airflow credentials. This occurs through the lack of token validation when executing ExecuteCallback for deadline-alert callbacks. Users are strongly recommended to upgrade to Apache Airflow version 3.4.0 or higher, which includes a fix that requires the worker to validate the callback's authentication token via the Execution API before execution.

Affected Version(s)

Apache Airflow 0 < 3.4.0

References

https://github.com/apache/airflow/pull/71192
patch
https://www.cve.org/CVERecord?id=CVE-2020-11981
related
https://github.com/apache/airflow/pull/70927
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Or Sahar (Reflectiz)
Sean Ghaeli
.