Threats tagged 'ghsa-3m38-qxxm-8g9g'

Apache Airflow's CeleryExecutor component allowed execution of callback workloads without validating authentication tokens. This flaw enables an attacker with write access to the Celery broker to enqueue forged callbacks that execute arbitrary code on all CeleryExecutor workers without needing Airflow credentials. The issue affects deployments using the CeleryExecutor. A fix is available in Apache Airflow version 3.4.0 and later, where token validation is enforced before executing callbacks.