Skip to main content
cve.nowby Sazabi
← Vulnerabilities
CVE-2026-96285

Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

Exploited
No known exploitation
Fix
Fixed in 3.4.0
Who is exposed
Not reported

Do first: Upgrade to a fixed version: 3.4.0.

Published
Last modified
12/100 · provisional
None on Exploit-DB, Metasploit or GitHub

Summary

Apache Airflow's scheduler and API server can run class constructors from crafted resume data, because a Dag author who controls a task's `next_kwargs` value can trigger deserialization before the dictionary check rejects it. This is an incomplete fix for CVE-2026-67260, so deployments that applied that earlier fix must also upgrade to the newer apache-airflow release that completes it.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded next_kwargs value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's next_kwargs through the task execution API, can therefore still trigger constructor execution in the scheduler when the awaiting_input timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.

cve.now Index

12Pcve.now Index 12 of 100 · methodology v3 · provisional
  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure?/25Unknown. No advisory context yet
  • Reach12/20apache-airflow-core: 647K downloads a week
  • Severity?/10Unknown. No CVSS score or vendor rating
  • No patch0/5No signal

What would change the score

  • Would score about 67 if added to CISA KEV
  • Would score about 62 if CISA's SSVC rates exploitation active
  • Would score about 34 if advisories confirm default setups are exposed

How the score works · Rankings

Impact

  • Widely used

    apache-airflow-core has 647k weekly downloads.Source: pypistats.org

    473 packages depend on apache-airflow-core.Source: deps.dev

What to do

  • Upgrade to a fixed version: 3.4.0.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • From 3.3.0 · fixed in 3.4.0

    Fixed in 3.4.0 (released Nov 6, 2026, 3 days before disclosure).

    The latest release, 3.4.0, is not affected.

Evidence 4

  1. Advisory
  2. Patch
  3. Patch
  4. Link

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-96285

Is CVE-2026-96285 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by CVE-2026-96285?

apache-airflow-core (PyPI): from 3.3.0 before 3.4.0.Source: cve.now feed data

How do I fix CVE-2026-96285?

Upgrade to a fixed version: 3.4.0.Source: cve.now feed data

Sources

Related

More vulnerabilities