Apache Airflow's Task SDK reconstructs a Callback object by re-running its constructor, which imports a module named by the stored callback path. The SyncCallback class passes the default allowed_deserialization_classes allow-list, which does not prevent arbitrary module imports. A DAG author controlling a task instance's next_kwargs via the task execution API can exploit this to import arbitrary modules during the scheduler's awaiting_input timeout sweep deserialization. This vulnerability affects version 3.3.0 only, as earlier versions did not have the scheduler sweep code path that triggers this. This issue is distinct from CVE-2026-58076 and CVE-2026-67260 and requires upgrading to apache-airflow 3.3.1 or later for remediation.

An attacker with DAG author privileges can cause the scheduler process to import arbitrary modules, potentially leading to code execution or other unintended behavior within the scheduler context. This could undermine the integrity and security of the Airflow scheduler. No non-default configuration is required to trigger this vulnerability, making it exploitable in default setups.

Users should upgrade Apache Airflow to version 3.3.1 or later, as this version addresses the vulnerability. No other configuration changes or temporary mitigations are indicated. Patch status is not explicitly confirmed in the advisory, but the recommendation to upgrade to 3.3.1 or later implies an official fix is available in those versions.