[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ebe8e7f5-cc8f-7959-4e07-21cb9ff37d3a@apache.org>
Date: Sun, 31 May 2026 12:08:58 +0000
From: Rahul Vats <rahulvats@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-45360: Apache Airflow: Arbitrary import in custom
deadline-reference deserialization
Severity: high
Affected versions:
- Apache Airflow (apache-airflow) before 3.2.2
Description:
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
Credit:
Jarek Potiuk (remediation developer)
References:
https://github.com/apache/airflow/pull/66737
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-45360
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
