Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-96285— Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

Quick assessment

Affected

Apache Software Foundation Apache Airflow

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Airflow 3.3.1 发布了一个针对 CVE-2026-67260 的修复，该修复会检查调度器（scheduler）中解码后的值是否为字典类型。然而，该检查仅在完整反序列化存储的负载（payload）之后才执行。反序列化过程会重建由反序列化白名单所允许的类（默认包含 Airflow 自身的类）的嵌套对象，并在调度器进程中调用这些类的构造函数，而此时尚未进行字典类型检查，因此无法阻止构造函数的执行。攻击者（即 DAG 作者）可通过任务执行 API 控制任务的值，从而在以下两种场景中触发调度器

AI Predicted 9.8 Difficulty: Moderate Updated Nov 09, 2026

Updated Nov 09, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

Source: CVE Program / CVE List V5

Vulnerability Description

Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Airflow	3.3.0 ~ 3.4.0	-

II. Public POCs for CVE-2026-96285

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-96285

请登录查看更多情报信息。

Other References for CVE-2026-96285 (1)

🔗 CVE Record: CVE-2026-67260 Read full article related

Other References for CVE-2026-96285 (3)

https://lists.apache.org/thread.html/5grvgsjw0c47q0pko8vnfy35drj4jyck vendor-advisory
https://github.com/apache/airflow/pull/73577 patch
https://github.com/apache/airflow/pull/73576 patch

https://www.cve.org/CVERecord?id=CVE-2026-96285

Same Patch Batch · Apache Software Foundation · 2026-11-09 · 28 CVEs total

CVE-2026-76185		Apache Airflow Task SDK: Task SDK SecretCache: non-injective team cache key enables cross-
CVE-2026-111455		Apache Airflow: Connections API: async connection test authorizes create at enqueue but ov
CVE-2026-111454		Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the call
CVE-2026-111453		Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value bu
CVE-2026-111452		Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhook
CVE-2026-111421		Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XCom
CVE-2026-111395		Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are reb
CVE-2026-107474		Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
CVE-2026-113504		Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-ne
CVE-2026-101031		Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IP
CVE-2026-113508		Apache Airflow: Logout token revocation fails open; errors silently swallowed
CVE-2026-86468		Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secre
CVE-2026-82337		Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side de
CVE-2026-86829		Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dep
CVE-2026-120367		Apache Axis2/Java: unbounded JSON request body buffering
CVE-2026-68982		Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without wo
CVE-2026-50204		Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection a
CVE-2026-40913		Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-F
CVE-2026-82440		Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Sc
CVE-2026-82436		Apache Storm Client: Deserialization of Untrusted Data from the State Store

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Airflow

Same vendor: Apache Software Foundation

Same weakness: CWE-502