CVE-2026-67587: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-67587 is a deserialization vulnerability in Apache Airflow's Task SDK that enables DAG authors to trigger arbitrary module imports inside the scheduler process, leading to remote code execution with scheduler privileges. It affects Apache Airflow version 3.3.0 only — versions before 3.3.0 are not affected because the scheduler sweep that reaches the vulnerable code path did not exist, and version 3.3.1 contains the fix. The vulnerability was disclosed on August 12, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Apache Advisory, GitHub Advisory).

The root cause (CWE-502: Deserialization of Untrusted Data) lies in how the Task SDK reconstructs a Callback object from serialized data: it re-runs the constructor, which calls Callback.get_callback_path() and imports the module named by the stored dotted-path string. Because SyncCallback is itself an Airflow class, it passes the default allowed_deserialization_classes allow-list, making that configuration control ineffective. A DAG author — who has write access to a task instance's next_kwargs via the task execution API — can store an arbitrary module path in serialized form; when the scheduler's awaiting_input timeout sweep runs (unconditionally, with no special configuration required), it deserializes the value and imports the attacker-controlled module, executing its module-level code inside the scheduler process. The fix (PR #70704) carries the path read from serialized data in a private str subclass and returns it unchanged rather than re-resolving it, eliminating the unnecessary import (GitHub PR, GitHub Advisory).

Successful exploitation grants a DAG author remote code execution within the scheduler process, which typically runs with elevated privileges and has broad access to the Airflow metadata database, DAG configurations, connections, and secrets. This can result in full confidentiality, integrity, and availability compromise of the scheduler and any resources it can reach, including potential lateral movement to connected systems via stored Airflow connections or credentials (GitHub Advisory, Apache Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.305% (0.003050), placing it in the 35th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges (DAG author access with task execution API write capability), but no user interaction or non-default configuration (GitHub Advisory, Apache Advisory).

1. Gain DAG author access: Obtain credentials or permissions for an account that can author DAGs and interact with the Airflow task execution API (low-privilege requirement).
2. Craft a malicious callback path: Prepare a dotted Python module path (e.g., malicious_package.payload) that, when imported, executes attacker-controlled code at module level (e.g., a reverse shell or data exfiltration routine).
3. Inject into next_kwargs: Use the task execution API to set a task instance's next_kwargs to include a serialized SyncCallback (or compatible Callback) object whose stored callback path points to the malicious module. Because SyncCallback is an Airflow class, it bypasses the allowed_deserialization_classes allow-list check.
4. Wait for the scheduler sweep: The scheduler's awaiting_input timeout sweep runs unconditionally and deserializes the stored Callback object, re-running its constructor and importing the attacker-specified module path inside the scheduler process.
5. Achieve code execution: Module-level code in the imported module executes with scheduler process privileges, enabling arbitrary command execution, credential theft, or further lateral movement (GitHub PR, GitHub Advisory).

• Logs: Unexpected ImportError log entries or successful import log messages in the Airflow scheduler log referencing unusual or external module paths; scheduler log entries showing deserialization activity for SyncCallback or Callback objects with non-standard dotted paths.
• Process: Unusual child processes spawned by the Airflow scheduler process (e.g., bash, python, curl, wget, or network utilities); unexpected outbound network connections originating from the scheduler process.
• File System: Presence of unexpected Python modules or packages in the Airflow environment's site-packages or DAG directories that contain executable module-level code; new files created by the scheduler process user in sensitive directories.
• Network: Outbound connections from the scheduler host to unknown external IPs or domains, particularly shortly after the awaiting_input timeout sweep interval.

Upgrade Apache Airflow to version 3.3.1 or later, which resolves the issue by no longer importing the stored module path when reconstructing a Callback from serialized data (Apache Advisory, GitHub PR). As a temporary workaround if immediate patching is not possible, restrict DAG author access to the task execution API and limit which users can control task instance next_kwargs. Note that tightening allowed_deserialization_classes does not mitigate this vulnerability, and fixes for the related CVE-2026-58076 and CVE-2026-67260 do not address this separate code path (GitHub Advisory).

The vulnerability was reported by Apache Airflow maintainer Jarek Potiuk (potiuk), who also authored the fix PR. The advisory explicitly notes this is a distinct code path from two other recently disclosed Airflow deserialization issues (CVE-2026-58076 and CVE-2026-67260), signaling a broader pattern of deserialization gadget discovery in Airflow's Task SDK. The NixOS security tracker opened an issue tracking Apache Airflow security issues below 3.3.1, reflecting community awareness of the cluster of related vulnerabilities (GitHub PR, Apache Advisory).