GHSA-3m38-qxxm-8g9gHighCVSS 7.3
Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline...
🔗 CVE IDs covered (1)
📋 Description
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-68982
- https://github.com/apache/airflow/pull/70927
- https://github.com/apache/airflow/pull/71192
- https://lists.apache.org/thread.html/7t514l87nhjworv2ns22b8ltxr1f7rhg
- https://www.cve.org/CVERecord?id=CVE-2020-11981
- https://github.com/advisories/GHSA-3m38-qxxm-8g9g