Threats tagged 'ghsa-5g3c-4f7x-qxvx'

Apache Airflow versions prior to 3.4.0 are vulnerable to unsafe deserialization in deadline alert fields. This vulnerability allows a DAG author to instantiate classes from Airflow's deserialization allow list with controlled arguments in the scheduler and API server processes. The issue persists despite a partial fix for CVE-2026-45360, which only addressed the 'reference' field, leaving 'callback' and 'interval' fields exploitable. Users are advised to upgrade to version 3.4.0 or later to mitigate this risk.