Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery (CVE-2026-68982)
Write access to the Celery broker is enough; 3.4.0 redeems a single-use token before any callback runs.
Stories per day · 30 days
Relatedapache-airflow2remote-code-execution2airflow1cwe-3061message-broker1missing-authentication1rce1redis1
1 stories, newest first · one card per story
Stories tagged #celery