CVE-2026-82337 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache Airflow rebuilds deadline alert fields through generic deserialization, which imports and instantiates classes named in a serialized Dag. A Dag author can construct classes on Airflow's deserialization allow list inside the scheduler and API server, using arguments they control.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments whose Dags use deadline alerts are affected, since the flaw is in how the scheduler and API server rebuild those alert fields from serialized Dags. Dag authors are the ones who can craft the payload, so teams that restrict who can write Dags have a smaller exposure. This is an incomplete fix of CVE-2026-45360; deployments that applied that fix remain affected through the callback and interval fields.
Not affected if no-deadline-alerts, restricted-dag-authors
Who cares apache-airflow, api-server, scheduler, self-hosted
DeadlineAlert or deadline_alerts in Dag code).airflow version; versions below 3.4.0 are in scope per the advisory.3.4.0 or later.Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected.
This is an incomplete fix of CVE-2026-45360, which only hardened the reference field; deployments that applied that fix remain affected through the callback and interval fields.
Users of apache-airflow are recommended to upgrade to 3.4.0 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.