Deserialization in Apache Airflow Dag run conf via deadline callbacks
Apache Airflow did not reject reserved serialization keys in Dag run conf. A user able to trigger a Dag using deadline alerts with asynchronous callbacks can include a conf that crashes the scheduler repeatedly or rebuilds objects in the Triggerer once the deadline is missed. An attacker gains denial of service or object reconstruction. All users running such Dags are affected.
What to do: Upgrade to Apache Airflow 3.4.0 or later. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | — | 3.4.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. Users are advised to upgrade to apache-airflow 3.4.0 or later.
Reserved serialization keys in Dag run conf can crash the scheduler repeatedly or be rebuilt as objects inside the Triggerer via deadline callbacks in versions before 3.4.0.
Today 1.6K readers · 2.4K views · 775 reads · all time 189K views