Live › vulnerability › CVE-2026-31072
Go to dashboardAPScheduler 4.0 alpha releases deserialize job data with JSONSerializer and CBORSerializer, which import arbitrary modules and call __setstate__ on any class in the environment. An attacker who can submit a crafted JSON or CBOR payload to an application using these serializers can execute code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:59 UTC, 0h before NVD. All times on this page are UTC.
Applications that use APScheduler 4.0 alpha releases with the JSONSerializer or CBORSerializer and that accept serialized payloads from users or other untrusted parties are exposed. The sources say the 3.10.x line is also listed as affected in the description, so check that version too. Teams that run APScheduler with the default serializer for internal, trusted data have less exposure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apscheduler | pypi | >= 4.0.0a1, <= 4.0.0a6 | – |
pip show apscheduler and check whether the version is between 4.0.0a1 and 4.0.0a6JSONSerializer or CBORSerializer from apscheduler to see whether they are usedapscheduler past 4.0.0a6; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling setstate on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers
This page as .md · .json · in your agent: get_signal("CVE-2026-31072")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.