Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery (CVE-2026-68982)
Write access to the Celery broker is enough; 3.4.0 redeems a single-use token before any callback runs.
Stories per day · 30 days
2 RSS
3 stories, newest first · one card per story
Stories tagged #message-broker
CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.
CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
Apache ActiveMQ CVE-2026-74761: moderate clientId spoofing in RemoveSubscription handling, affecting Broker, All and apache-activemq, fixed in 6.3.2 and 5.19.11.