Apache Airflow mishandles reserved keys in Dag run conf triggering scheduler crashes or Triggerer object reconstruction…
Original title: CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
Reserved serialization keys in Dag run conf can crash the scheduler repeatedly or be rebuilt as objects inside the Triggerer via deadline callbacks in versions before 3.4.0.
Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag using a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. The vulnerability affects Apache Airflow 3.2.0 before 3.4.0. Users are advised to upgrade.
- Reserved keys in Dag run conf not rejected
- Scheduler crashes on missed deadline
- Objects rebuilt in Triggerer
- Affects 3.2.0 before 3.4.0
Impact: scheduler crash or Triggerer deserialization
- 1.Upgrade to Apache Airflow 3.4.0 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111395 | Deserialization in Apache Airflow Dag run conf via deadline callbacks | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow 3. 2. 0 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.