PUBLISHED
2026-06-01 09:16
MODIFIED
2026-06-01 09:16
EPSS (Prob. Exploit)
0.93%
Top 39.8%
> DESCRIPTION
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
> GITHUB SECURITY ADVISORY
GHSA-2r5m-76wx-56gx
HIGH
Apache Airflow Vulnerable to Deserialization of Untrusted Data
AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.2.0, < 3.2.2
Fixed in: 3.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Arbitrary import in custom deadline-reference deserialization
AFFECTED PACKAGES:
Unknown / Unknown
8238 versions affected
ALIASES:
BIT-airflow-2026-45360, GHSA-2r5m-76wx-56gx, PYSEC-2026-186
> HISTORIQUE DES MODIFICATIONS
Première apparition
01/06/2026 09:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Total des modifications: 1
Dernière mise à jour: 4 months ago