Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery

Original title: Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution

GBHackersby Divya ()2 min read
Read at gbhackers.com
Part of a story covered by 3 sourcesAirflow CeleryExecutor flaw lets broker writers run code on workersMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A public proof of concept shows a broker message can invoke any importable Python function without Airflow credentials.

Or Sahar of Reflectiz found CVE-2026-68982, a missing-authentication flaw in Apache Airflow before 3.4.0 when CeleryExecutor is used. ExecuteCallback messages on the Celery broker are not authenticated, so anyone who can write to the broker can make a worker import and call a chosen Python function. He confirmed it on 3.2.1 and 3.3.0 in lab setups. The report includes a proof of concept and does not say the flaw is exploited in the wild.

Unconfirmed: The report does not say whether attackers are exploiting CVE-2026-68982 outside lab proof-of-concept tests.

Key facts
  • The bug is classified as CWE-306 and needs no Airflow credentials.
  • Sahar confirmed it on Airflow 3.2.1 and 3.3.0 with Redis and PostgreSQL.
  • ExecuteTask messages carry a signed token; ExecuteCallback messages are not checked.
  • Workers load the named function with import_module and getattr and call it immediately.
Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated code execution on Celery workers

ProductAffectedFixed in
Apache Airflowbefore 3.4.0 using CeleryExecutor3.4.0
What to do
  1. 1.Upgrade Apache Airflow deployments that use CeleryExecutor to 3.4.0.
  2. 2.Restrict who can publish messages to the Celery broker.
Analyze CVE-2026-68982 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-68982
ATT&CK
T1059.006 Python
Tags
apache-airflowceleryremote-code-executionmissing-authenticationcwe-306
Vendors
Apache
Products
Apache Airflow
Organizations
Reflectiz

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-68982
Arbitrary code execution in Apache Airflow CeleryExecutor via forged callbacks
——

From the original article

2 min read at gbhackers.com

A critical missing-authentication flaw in Apache Airflow lets attackers run code on Celery workers without any Airflow credentials. Tracked as CVE-2026-68982, the bug is classified as CWE-306 and affects Airflow versions before 3. 4.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.