Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery (CVE-2026-68982)
Write access to the Celery broker is enough; 3.4.0 redeems a single-use token before any callback runs.
68
Organization
Reflectiz
- Mentions · 7d2
- Mentions · 30d3
- All mentions4
- First seenSep 8, 2026
- Last mentioned1d ago
Timeline
4 articles · newest firstApache Airflow before 3.4.0 allows unauthenticated RCE via Celery
A public proof of concept shows a broker message can invoke any importable Python function without Airflow credentials.
68
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
Reflectiz says its AI pentest agent found a critical OTP bypass on a major insurer's website.
46
Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests
Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests.
20
Related CVEs
by mentions- Arbitrary code execution in Apache Airflow CeleryExecutor via forged callbacks
Appears with
- Apachevendor · 2
- Reflectizvendor · 2
- Apache Airflowproduct · 2
- Reflectiz Offensive Hubproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.