{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67260", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-29T10:04:08.525Z", "datePublished": "2026-08-12T15:33:02.858Z", "dateUpdated": "2026-11-03T06:59:09.280Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.3.1", "status": "affected", "version": "3.3.0", "versionType": "semver"}], "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow-core"}], "credits": [{"lang": "en", "type": "finder", "value": "Erik Villegas (GitHub: @erik-451)"}, {"lang": "en", "type": "remediation developer", "value": "Jarek Potiuk"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution API \u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere \u2014 deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later."}], "value": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution API \u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere \u2014 deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:59:09.280Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/airflow/pull/70685"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-58076"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization", "x_generator": {"engine": "airflow-s/generate_cve_json.py"}, "x_gcve": [{"vulnId": "CVE-2026-67260", "recordType": "advisory"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T16:00:14.166719Z", "id": "CVE-2026-67260", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T16:00:19.739Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-67260", "date": "2026-11-13", "epss": "0.00779", "percentile": "0.56442"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-67260\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-08-12T16:17:14.813\",\"lastModified\":\"2026-11-03T07:20:56.523\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution API \u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere \u2014 deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.\"},{\"lang\":\"es\",\"value\":\"Apache Airflow 3.3.0 movi\u00f3 las tareas con intervenci\u00f3n humana del disparador a un nuevo estado de tarea \u201cawaiting_input\u201d barrido por el planificador. Ese barrido deserializa los \u201cnext_kwargs\u201d de la instancia de tarea sin una lista de permitidos, por lo que un autor de Dag - quien controla ese valor a trav\u00e9s de la API de ejecuci\u00f3n de tareas - puede causar una importaci\u00f3n de m\u00f3dulo arbitraria y una instanciaci\u00f3n de objeto dentro del proceso del planificador, o terminar el trabajo del planificador. No se requiere ninguna configuraci\u00f3n no predeterminada: el barrido se ejecuta incondicionalmente cada 15 segundos, y la configuraci\u00f3n predeterminada de \u201callowed_deserialization_classes\u201d no cubre esta ruta de c\u00f3digo. Las versiones anteriores a la 3.3.0 no est\u00e1n afectadas, porque las tareas con intervenci\u00f3n humana se aplazaban al disparador en su lugar. Esta es una ruta de c\u00f3digo diferente de CVE-2026-58076, que cubre la misma deserializaci\u00f3n de nodo de excepci\u00f3n sin protecci\u00f3n alcanzada en otro lugar - las implementaciones que aplicaron esa correcci\u00f3n tambi\u00e9n deben actualizarse para este problema. Se aconseja a los usuarios actualizar a apache-airflow 3.3.1 o posterior.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Airflow\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pypi.python.org\",\"packageName\":\"apache-airflow-core\",\"packageURL\":\"pkg:pypi/apache-airflow-core\",\"versions\":[{\"version\":\"3.3.0\",\"lessThan\":\"3.3.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-12T16:00:14.166719Z\",\"id\":\"CVE-2026-67260\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3.0\",\"versionEndExcluding\":\"3.3.1\",\"matchCriteriaId\":\"F6D5F0B2-15A2-4782-8CC5-769E57D5F2F6\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/airflow/pull/70685\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2026-58076\",\"source\":\"security@apache.org\",\"tags\":[\"Not Applicable\"]}]}}", "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-67260\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-12T16:00:14.166719Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-12T16:00:03.271Z\"}}], \"cna\": {\"title\": \"Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Erik Villegas (GitHub: @erik-451)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Jarek Potiuk\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.3.0\", \"lessThan\": \"3.3.1\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:pypi/apache-airflow-core\", \"packageName\": \"apache-airflow-core\", \"collectionURL\": \"https://pypi.python.org\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/airflow/pull/70685\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2026-58076\", \"tags\": [\"related\"]}], \"x_generator\": {\"engine\": \"airflow-s/generate_cve_json.py\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \\u2014 who controls that value through the task execution API \\u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere \\u2014 deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \\u2014 who controls that value through the task execution API \\u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere \\u2014 deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-11-03T06:59:09.280Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-67260\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-11-03T06:59:09.280Z\", \"dateReserved\": \"2026-07-29T10:04:08.525Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-08-12T15:33:02.858Z\", \"assignerShortName\": \"apache\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}