Potential Deserialization Flaw in Apache Airflow Affects Scheduler Process

CVE-2026-96285

What is CVE-2026-96285?

An incomplete fix in Apache Airflow allows a potential deserialization vulnerability in the scheduler process. Specifically, the scheduler deserializes the 'next_kwargs' value without validating its structure first, which could enable malicious users to trigger constructor execution within the scheduler. Users should upgrade to Apache Airflow 3.4.0 or later to fully mitigate this issue, as versions prior to 3.3.0 are unaffected. This vulnerability arises from changes applied to address a previous issue and must be handled with appropriate updates to ensure the secure operation of deployments.

References