CVE-2026-67260

Name of the Vulnerable Software and Affected Versions Apache Airflow version 3.3.0

Description In the awaiting input task state, the scheduler deserializes the next kwargs variable of a task instance without using an allow-list. A DAG author can manipulate this value via the task execution API to trigger arbitrary module imports and object instantiation within the scheduler process, or cause the scheduler job to terminate. This process occurs automatically every 15 seconds and is not mitigated by the default allowed deserialization classes setting.

Recommendations Upgrade to apache-airflow version 3.3.1 or later.