{"id":"CVE-2026-96285","kind":"vulnerability","aliases":["CVE-2026-96285"],"related":[],"title":"Apache Airflow: incomplete fix lets a DAG author run code in the scheduler","description":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.","summary":"Airflow 3.3.1's fix for CVE-2026-67260 checks the decoded next_kwargs value only after the whole payload is deserialized, so constructors of allow-listed classes still run first. A DAG author who controls a task's next_kwargs can trigger that constructor execution inside the scheduler or API server.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","kubernetes","python","runtime","self-hosted"],"not_affected_if":["dag-authors-trusted","versions-before-3.3.0"],"how_to_check":"- Check the installed version with `airflow version`; versions from `3.3.0` up to `3.3.1` are exposed to this issue.\n- Confirm whether the deployment was upgraded to `3.3.1` for CVE-2026-67260, since that upgrade does not fully fix this issue.","fix":"- apache-airflow: upgrade to `3.4.0` or later","status":"open","published_at":"2026-11-09T10:17:16+00:00","first_seen_at":"2026-11-09T10:25:50+00:00","triaged_at":"2026-11-09T10:26:30+00:00","updated_at":"2026-11-09T10:26:30+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T10:26:30Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow: upgrade to `3.4.0` or later","reach":"network","title":"Apache Airflow: incomplete fix lets a DAG author run code in the scheduler","impact":"high","summary":"Airflow 3.3.1's fix for CVE-2026-67260 checks the decoded next_kwargs value only after the whole payload is deserialized, so constructors of allow-listed classes still run first. A DAG author who controls a task's next_kwargs can trigger that constructor execution inside the scheduler or API server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-airflow","python","self-hosted","kubernetes"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"code runs in the scheduler or API server process","analyst_note":"Sources give no CVSS or exploitation status; confirm severity and check the Apache Airflow advisory for CVE-2026-96285.","how_to_check":"- Check the installed version with `airflow version`; versions from `3.3.0` up to `3.3.1` are exposed to this issue.\n- Confirm whether the deployment was upgraded to `3.3.1` for CVE-2026-67260, since that upgrade does not fully fix this issue.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-before-3.3.0","dag-authors-trusted"],"who_is_affected":"Deployments of Apache Airflow 3.3.0 and later are affected, including those that upgraded to 3.3.1 for CVE-2026-67260. The exposure comes from DAG authors who can set a task's next_kwargs through the task execution API, so the risk is highest where many people can write DAGs. Versions before 3.3.0 are not affected, and no non-default configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000807,"input_tokens":4791,"output_tokens":656,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A,35B,89C,223C '-67260':36B,90C,224C '-96285':16A,19A '3.3.0':212C '3.3.1':30B,83C,229C '3.4.0':240C 'affect':215C 'airflow':2A,22B,29B,82C,131C,239C 'allow':54B,125C 'allow-list':53B,124C 'also':234C 'apach':1A,21B,81C,238C 'apache-airflow':20B,237C 'api':79B,164C,186C,201C 'author':8A,62B,152C 'await':176C 'check':37B,92C,106C,145C 'class':56B,119C,134C 'code':10A 'configur':207C 'constructor':51B,73B,138C,169C 'control':64B,154C 'cve':14A,17A,34B,88C,222C 'dag':7A,61B,151C 'decod':39B,96C 'default':129C,206C 'deploy':225C 'deseri':49B,109C,114C,123C 'dictionari':102C 'execut':74B,163C,170C,200C 'first':59B 'fix':4A,32B,86C,220C 'host':28B 'includ':130C 'incomplet':3A,219C 'input':177C 'insid':75B,139C 'instanc':191C 'issu':232C 'kubernet':23B 'kwarg':41B,69B,98C,159C 'later':242C 'let':5A 'list':55B,126C 'must':233C 'nest':116C 'next':40B,68B,97C,158C 'non':205C 'non-default':204C 'object':117C 'older':199C 'payload':47B,113C 'perform':104C 'permit':120C 'process':142C,180C 'python':24B 'reconstruct':115C 'reject':147C 'requir':209C 'run':9A,58B,136C 'runtim':25B 'schedul':13A,77B,94C,141C,173C 'self':27B 'self-host':26B 'serv':193C 'server':80B,187C 'ship':84C 'still':57B,167C 'store':112C 'sweep':179C 'task':66B,156C,162C,182C,190C 'therefor':166C 'timeout':178C 'trigger':71B,168C 'upgrad':227C,235C 'use':197C 'valu':42B,99C,149C 'version':202C,210C 'whole':46B,111C 'worker':196C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache Airflow 3.3.0 and later are affected, including those that upgraded to 3.3.1 for CVE-2026-67260. The exposure comes from DAG authors who can set a task's next_kwargs through the task execution API, so the risk is highest where many people can write DAGs. Versions before 3.3.0 are not affected, and no non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","high","kubernetes","python","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96285':16A,19A 'airflow':2A 'apach':1A 'author':8A 'code':10A 'cve':14A,17A 'dag':7A 'fix':4A 'incomplet':3A 'let':5A 'run':9A 'schedul':13A","search_b":"'-2026':35B '-67260':36B '3.3.1':30B 'airflow':22B,29B 'allow':54B 'allow-list':53B 'apach':21B 'apache-airflow':20B 'api':79B 'author':62B 'check':37B 'class':56B 'constructor':51B,73B 'control':64B 'cve':34B 'dag':61B 'decod':39B 'deseri':49B 'execut':74B 'first':59B 'fix':32B 'host':28B 'insid':75B 'kubernet':23B 'kwarg':41B,69B 'list':55B 'next':40B,68B 'payload':47B 'python':24B 'run':58B 'runtim':25B 'schedul':77B 'self':27B 'self-host':26B 'server':80B 'still':57B 'task':66B 'trigger':71B 'valu':42B 'whole':46B","search_c":"'-2026':89C,223C '-67260':90C,224C '3.3.0':212C '3.3.1':83C,229C '3.4.0':240C 'affect':215C 'airflow':82C,131C,239C 'allow':125C 'allow-list':124C 'also':234C 'apach':81C,238C 'apache-airflow':237C 'api':164C,186C,201C 'author':152C 'await':176C 'check':92C,106C,145C 'class':119C,134C 'configur':207C 'constructor':138C,169C 'control':154C 'cve':88C,222C 'dag':151C 'decod':96C 'default':129C,206C 'deploy':225C 'deseri':109C,114C,123C 'dictionari':102C 'execut':163C,170C,200C 'fix':86C,220C 'includ':130C 'incomplet':219C 'input':177C 'insid':139C 'instanc':191C 'issu':232C 'kwarg':98C,159C 'later':242C 'list':126C 'must':233C 'nest':116C 'next':97C,158C 'non':205C 'non-default':204C 'object':117C 'older':199C 'payload':113C 'perform':104C 'permit':120C 'process':142C,180C 'reconstruct':115C 'reject':147C 'requir':209C 'run':136C 'schedul':94C,141C,173C 'serv':193C 'server':187C 'ship':84C 'still':167C 'store':112C 'sweep':179C 'task':156C,162C,182C,190C 'therefor':166C 'timeout':178C 'trigger':168C 'upgrad':227C,235C 'use':197C 'valu':99C,149C 'version':202C,210C 'whole':111C 'worker':196C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96285","severity":null,"published_at":"2026-11-09T10:17:16+00:00","modified_at":"2026-11-09T10:17:16+00:00","first_seen_at":"2026-11-09T10:25:50+00:00","fetched_at":"2026-11-09T10:25:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}