Skip to content
Fencer Vulns
critical 9.8

CVE-2026-31072 json

APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

published 2026-05-19 5 mo ago modified 2026-10-27 12 d ago also GHSA-9cfw-f3f9-7mm7 , PYSEC-2026-282 , EUVD-2026-30947

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31072 updated cvss 8.8

apscheduler: APScheduler: Remote Code Execution via Insecure Deserialization

  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-tech-preview/metrics-service-rhel9 Red Hat OpenStack Platform 18.0 python-APScheduler Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9 Red Hat Satellite 6 satellite/iop-vmaas-rhel9, satellite/iop-host-inventory-rhel9, satellite/iop-advisor-backend-rhel9, satellite/iop-vulnerability-engine-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gist.github.com https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi apscheduler
>=4.0.0a1, <=4.0.0a6
 no fix listed

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenStack Platform 18.0
  • Red Hat Red Hat Quay 3
  • Red Hat Red Hat Satellite 6

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.