Deserialization Vulnerability in Apache Airflow Affects Deadline Alert Functionality

CVE-2026-82337

What is CVE-2026-82337?

Apache Airflow contains a deserialization vulnerability impacting the deadline alert fields due to generic deserialization processes in the scheduler and API server. Attackers can exploit this flaw when a Dag author uses deadline alerts, potentially allowing unauthorized constructions of classes within Airflow's deserialization allow list with manipulated parameters. This flaw is a partial fix of a previous vulnerability (CVE-2026-45360), which only covered the reference field, leaving callback and interval fields susceptible to exploitation. Users are advised to upgrade to version 3.4.0 or above to mitigate these risks.

References