CVE-2026-67587 json
Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget
published 2026-08-12 2 mo ago modified 2026-11-03 6 d ago also BIT-airflow-2026-67587 , EUVD-2026-57274 , GHSA-2qjv-p2gc-mjg2 , PYSEC-2026-3708
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Patch / fix
- pypi apache-airflow 3.3.1
- bitnami airflow 3.3.1
- Apache Software Foundation Apache Airflow 3.3.1
- github.com/apache/airflow@1baee0b commit
- github.com/apache/airflow@2b598cb commit
- github.com/apache/airflow#70704 pull request
- github.com/apache/airflow/releases/tag/3.3.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | >=3.3.0, <3.3.1 |
3.3.1 |
| bitnami | airflow | >=3.3.0, <3.3.1 |
3.3.1 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/airflow/pull/70704
patch, web, issue-tracking
-
github.com
/apache/airflow/commit/1baee0bf987eb220f15398e43572e1ed819a0130
web
-
github.com
/apache/airflow/commit/2b598cb8b0570c941633be3d16a7eb912f73180c
web
-
lists.apache.org
/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0
vendor-advisory, web, mailing-list, advisory
-
cve.org
/CVERecord?id=CVE-2026-58076
related, web, not-applicable
-
cve.org
/CVERecord?id=CVE-2026-67260
related, web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2026-67587
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/apache/airflow/releases/tag/3.3.1
web
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-3708.yaml
web
-
github.com
/advisories/GHSA-2qjv-p2gc-mjg2
advisory
Sources
- CVE List CVE-2026-67587
- GitHub Advisory GHSA-2qjv-p2gc-mjg2
- NVD CVE-2026-67587
- OSV BIT-airflow-2026-67587
- OSV PYSEC-2026-3708
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.