Skip to main content
cve.nowby Sazabi
← Vulnerabilities
CVE-2026-82337

Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization

Exploited
No known exploitation
Fix
Fixed in 3.4.0
Who is exposed
Not reported

Do first: Upgrade to a fixed version: 3.4.0.

Published
Last modified
12/100 · provisional
None on Exploit-DB, Metasploit or GitHub

Summary

Apache Airflow deployments that use deadline alerts are affected. A Dag author can cause classes on Airflow's deserialization allow list to be constructed in the scheduler and API server, using arguments the author controls.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected.

This is an incomplete fix of CVE-2026-45360, which only hardened the reference field; deployments that applied that fix remain affected through the callback and interval fields.

Users of apache-airflow are recommended to upgrade to 3.4.0 or later.

cve.now Index

12Pcve.now Index 12 of 100 · methodology v3 · provisional
  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure?/25Unknown. No advisory context yet
  • Reach12/20apache-airflow-core: 647K downloads a week
  • Severity?/10Unknown. No CVSS score or vendor rating
  • No patch0/5No signal

What would change the score

  • Would score about 67 if added to CISA KEV
  • Would score about 62 if CISA's SSVC rates exploitation active
  • Would score about 34 if advisories confirm default setups are exposed

How the score works · Rankings

Impact

  • Widely used

    apache-airflow-core has 647k weekly downloads.Source: pypistats.org

    473 packages depend on apache-airflow-core.Source: deps.dev

What to do

  • Upgrade to a fixed version: 3.4.0.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • fixed in 3.4.0

    Fixed in 3.4.0 (released Nov 6, 2026, 3 days before disclosure).

    The latest release, 3.4.0, is not affected.

Evidence 4

  1. Advisory
  2. Patch
  3. Patch
  4. Link

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-82337

Is CVE-2026-82337 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by CVE-2026-82337?

apache-airflow-core (PyPI): before 3.4.0.Source: cve.now feed data

How do I fix CVE-2026-82337?

Upgrade to a fixed version: 3.4.0.Source: cve.now feed data

Sources

Related

More vulnerabilities