Threats tagged 'ghsa-h6xc-w3fp-2wwj'

Apache Airflow versions before 3.3.0 are not affected by CVE-2026-96285. Version 3.3.1 includes a partial fix that checks the scheduler's decoded next_kwargs value is a dictionary only after deserializing the entire stored payload. This deserialization process reconstructs nested objects and runs their constructors before the check, allowing a DAG author to trigger constructor execution in the scheduler and API server without non-default configuration. The fix in 3.3.1 is incomplete; deployments must upgrade to version 3.4.0 or later for a complete resolution.