---
id: "CVE-2026-31072"
kind: "vulnerability"
aliases: ["CVE-2026-31072", "GHSA-9cfw-f3f9-7mm7"]
title: "APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization"
severity: "critical"
cvss: 9.8
epss: 0.0081
exploited: false
status: "open"
category: "package"
products: [{"name": "apscheduler", "fixed": [], "affected": ">= 4.0.0a1, <= 4.0.0a6", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["apscheduler", "cwe-502", "package", "python", "self-hosted"]
not_affected_if: ["default-config", "no-untrusted-input"]
published_at: "2026-05-19T16:16:20+00:00"
first_seen_at: "2026-10-27T15:59:48+00:00"
updated_at: "2026-10-27T16:03:35+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9cfw-f3f9-7mm7", "first_seen_at": "2026-10-27T15:59:48+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31072", "first_seen_at": "2026-10-27T16:03:35+00:00"}]
---

# APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

APScheduler 4.0 alpha releases deserialize job data with JSONSerializer and CBORSerializer, which import arbitrary modules and call __setstate__ on any class in the environment. An attacker who can submit a crafted JSON or CBOR payload to an application using these serializers can execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:apscheduler affected >= 4.0.0a1, <= 4.0.0a6 fixed ?

## How to check

- Run `pip show apscheduler` and check whether the version is between `4.0.0a1` and `4.0.0a6`
- Search the project for `JSONSerializer` or `CBORSerializer` from `apscheduler` to see whether they are used
- Check whether any externally supplied data reaches serialized scheduler job or event data

## Fix

- Upgrade `apscheduler` past `4.0.0a6`; the fixed version is unknown from the sources
- Until upgraded, avoid the JSON and CBOR serializers for data that comes from untrusted sources

## Timeline

- 2026-10-27T15:59:48+00:00 ghsa https://github.com/advisories/GHSA-9cfw-f3f9-7mm7
- 2026-10-27T16:03:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-31072

## From the sources

The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_