CVE-2026-58076

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description The serialization layer fails to restrict the classes imported during the reconstruction of exception nodes. By calling import string() on a class name and instantiating it with arguments from a serialized blob, the system allows an arbitrary callable to be imported and invoked. This can be triggered via an operator's executor config, enabling a Dag author to execute functions such as subprocess.check output or builtins.eval. The issue affects the Scheduler, which reconstructs serialized Dags, and the API server via the GET /api/v2/dags/{dag id}/details endpoint. Both components have access to metadata database credentials and the JWT signing secret.

Recommendations Upgrade to apache-airflow version 3.3.1 or later.