CVE-2026-96285

Full vulnerability record from the local CVENow database.

Description

Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-09 10:17:16.203000

Last modified

2026-11-09 10:17:16.203000

View original CVE JSON

{
  "id": "CVE-2026-96285",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-09T10:17:16.203",
  "lastModified": "2026-11-09T10:17:16.203",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.python.org",
          "packageName": "apache-airflow-core",
          "packageURL": "pkg:pypi/apache-airflow-core",
          "versions": [
            {
              "version": "3.3.0",
              "lessThan": "3.4.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/73576",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apache/airflow/pull/73577",
      "source": "[email protected]"
    },
    {
      "url": "https://lists.apache.org/thread.html/5grvgsjw0c47q0pko8vnfy35drj4jyck",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67260",
      "source": "[email protected]"
    }
  ]
}