Apache Airflow before 3.4.0 allows deserialization of DeadlineAlert fields (CVE-2026-82337)
Original title: CVE-2026-82337: Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization
Dag authors can construct arbitrary classes in scheduler and API server processes.
Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use the affected feature are impacted.
- Classes constructed in scheduler and API server
- Uses Airflow deserialization allow list
- Affects all Dag-using deployments
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82337 | Deserialization bypass in Apache Airflow DeadlineAlert fields | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.