CVE-2026-67260: CWE-502: Deserialization of Untrusted Data in Apache Software Foundation Apache Airflow
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.
AI Analysis
Technical Summary
Apache Airflow 3.3.0 introduced a new handling mechanism for human-in-the-loop tasks, moving them from the triggerer to an awaiting_input task state managed by the scheduler. During the scheduler's periodic sweep (every 15 seconds), it deserializes the next_kwargs attribute of task instances without enforcing an allow-list of safe classes. Since DAG authors control next_kwargs via the task execution API, this allows them to cause arbitrary module imports and object instantiations within the scheduler process or to terminate the scheduler job. This vulnerability is distinct from CVE-2026-58076 and affects only version 3.3.0. Upgrading to Apache Airflow 3.3.1 or later is advised to address this issue.
Potential Impact
An attacker with DAG author privileges can exploit this vulnerability to execute arbitrary code within the scheduler process or cause the scheduler to terminate unexpectedly. This could lead to denial of service or unauthorized code execution within the Airflow scheduler environment. No non-default configuration is required for exploitation, making the default installation vulnerable if running version 3.3.0.
Mitigation Recommendations
Users should upgrade Apache Airflow to version 3.3.1 or later, where this vulnerability is fixed. There is no indication of a temporary workaround or configuration change to mitigate this issue. Deployments that have applied fixes for CVE-2026-58076 must also upgrade to 3.3.1 or later to address this separate deserialization vulnerability.
CVE-2026-67260: CWE-502: Deserialization of Untrusted Data in Apache Software Foundation Apache Airflow
Description
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.
CVSS v3.1
Score 7.3high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Airflow 3.3.0 introduced a new handling mechanism for human-in-the-loop tasks, moving them from the triggerer to an awaiting_input task state managed by the scheduler. During the scheduler's periodic sweep (every 15 seconds), it deserializes the next_kwargs attribute of task instances without enforcing an allow-list of safe classes. Since DAG authors control next_kwargs via the task execution API, this allows them to cause arbitrary module imports and object instantiations within the scheduler process or to terminate the scheduler job. This vulnerability is distinct from CVE-2026-58076 and affects only version 3.3.0. Upgrading to Apache Airflow 3.3.1 or later is advised to address this issue.
Potential Impact
An attacker with DAG author privileges can exploit this vulnerability to execute arbitrary code within the scheduler process or cause the scheduler to terminate unexpectedly. This could lead to denial of service or unauthorized code execution within the Airflow scheduler environment. No non-default configuration is required for exploitation, making the default installation vulnerable if running version 3.3.0.
Mitigation Recommendations
Users should upgrade Apache Airflow to version 3.3.1 or later, where this vulnerability is fixed. There is no indication of a temporary workaround or configuration change to mitigate this issue. Deployments that have applied fixes for CVE-2026-58076 must also upgrade to 3.3.1 or later to address this separate deserialization vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-29T10:04:08.525Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c944ebf8831d539c07f4d
Added to database: 08/12/2026, 15:42:06 UTC
Last enriched: 08/12/2026, 16:01:39 UTC
Last updated: 08/12/2026, 20:13:32 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.