Apache Airflow CeleryExecutor vulnerability allows forged callback workloads
Original title: CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Apache Airflow CeleryExecutor ran callback workloads without workload-token validation, allowing arbitrary code execution on Celery workers.
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected. Affected versions are Apache Airflow before 3.4.0.
- Severity: important
- No Airflow credentials needed for execution
- Affects CeleryExecutor deployments
Impact: arbitrary code execution on Celery workers
- 1.Upgrade to Airflow 3.4.0 or later
- CVEs
- CVE-2026-68982
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68982 | Arbitrary code execution in Apache Airflow CeleryExecutor via forged callbacks | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.