Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery (CVE-2026-68982)

Original title: Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication

Cyber Security Newsby Abinaya ()3 min read
Read at cybersecuritynews.com
Part of a story covered by 3 sourcesAirflow CeleryExecutor flaw lets broker writers run code on workersMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Write access to the Celery broker is enough; 3.4.0 redeems a single-use token before any callback runs.

Apache Airflow versions before 3.4.0 that use CeleryExecutor accept unauthenticated ExecuteCallback messages on the Celery broker and run them on workers. ExecuteTask messages carry a signed JWT, but callbacks on the same execute_workload task are not validated, so a crafted message can import a module and execute it. Reflectiz confirmed the issue in lab setups of 3.2.1 and 3.3.0. Airflow 3.4.0, released November 6, 2026, is the only fix.

Unconfirmed: Reflectiz scored the flaw 9.8; Apache has not published a CVSS score, and in-the-wild exploitation is not reported.

Key facts
  • The flaw is CVE-2026-68982, classified as CWE-306, missing authentication for a critical function.
  • Deadline Alerts need not be enabled; the handler loads with the Celery provider.
  • A lab proof of concept created no DagRuns or TaskInstances and dumped AIRFLOW environment variables.
  • Reflectiz said 198 of 211 reachable Redis brokers answered without authentication.
  • Apache rates the issue Important and has not published a CVSS score.
Security assessment · AI, from the articlePublic proof of concept

Impact: remote code execution on CeleryExecutor workers

ProductAffectedFixed in
Apache Airflowbefore 3.4.0 that run CeleryExecutor3.4.0
What to do
  1. 1.Upgrade the Execution API server and every CeleryExecutor worker to Airflow 3.4.0.
  2. 2.Enable Redis AUTH or RabbitMQ credentials and block ports 6379 and 5672 from the internet.
  3. 3.Audit broker traffic and Celery worker logs for unexpected execute_workload messages.
Analyze CVE-2026-68982 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-68982
ATT&CK
T1059 Command and Scripting Interpreter
Tags
apache-airflowceleryremote-code-executionredismessage-broker
Vendors
Apache
Products
Apache Airflow
Organizations
Reflectiz

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-68982
Arbitrary code execution in Apache Airflow CeleryExecutor via forged callbacks
——

From the original article

3 min read at cybersecuritynews.com

Apache Airflow has a critical remote code execution flaw that lets anyone with write access to the Celery message broker run code on worker nodes. The attacker needs no credentials, DAG, or scheduler. The bug is tracked as CVE-2026-68982 and is classified as CWE-306, missing authentication for a critical function.

Cyber Security News

By Abinaya · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.