Apache Airflow before 3.4.0 allows deserialization of DeadlineAlert fields (CVE-2026-82337)
Dag authors can construct arbitrary classes in scheduler and API server processes.
55
Vulnerability1 · 1 read
CVE-2026-82337
Deserialization bypass in Apache Airflow DeadlineAlert fields
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's scheduler and API server perform generic deserialization on deadline alert fields from serialized Dags. A Dag author can trigger instantiation of classes in the deserialization allow list with controlled arguments. This affects all deployments using deadline alerts and is an incomplete fix for CVE-2026-45360 through the callback and interval fields. Attackers gain potential for controlled object construction in those processes.
What to do: Upgrade Apache Airflow to 3.4.0 or later. No workaround is mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | < 3.4.0 | 3.4.0 or later |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected. This is an incomplete fix of CVE-2026-45360, which only hardened the `reference` field; deployments that applied that fix remain affected through the `callback` and `interval` fields. Users of apache-airflow are recommended to upgrade to 3.4.0 or later.
- Weakness
- CWE-502