Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery (CVE-2026-68982)
Write access to the Celery broker is enough; 3.4.0 redeems a single-use token before any callback runs.
68
CVE-2026-68982
Arbitrary code execution in Apache Airflow CeleryExecutor via forged callbacks
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's CeleryExecutor runs callback workloads without validating the workload's authentication token. An attacker able to write to the Celery broker can enqueue a forged callback to execute arbitrary code on every worker without Airflow credentials. All CeleryExecutor deployments are affected.
What to do: Upgrade to Apache Airflow 3.4.0 or later. No workaround mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | — | 3.4.0 or later |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
- Weakness
- CWE-306
In the news
3 storiesApache Airflow before 3.4.0 allows unauthenticated RCE via Celery
A public proof of concept shows a broker message can invoke any importable Python function without Airflow credentials.
68
Apache Airflow CeleryExecutor vulnerability allows forged callback workloads
Apache Airflow CeleryExecutor ran callback workloads without workload-token validation, allowing arbitrary code execution on Celery workers.
60