CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.
CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.
- CVE-2026-86792: RCE on Airflow Scheduler via Kafka connection config
- import_string resolves extra-field dotted paths into Python callables with no allowlist
- Affects apache-airflow-providers-apache-kafka 1.15.0 before 2.0.0
- Upstream severity moderate; requires connection configuration access
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-86792 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow Apache Kafka provider (apache-airflow-providers-apache-kafka) 1.15.0 before 2.0.0 Description: Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have...
This source does not provide full text. Read it at seclists.org.