CVE-2026-68982
Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
What each source reports
CVE List No score
Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
- Record
CVE-2026-68982- Weakness
- CWE-306
- Updated
- 2026-11-09
EUVDEUVD-2026-119905 No score
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
- Record
EUVD-2026-119905- Updated
- 2026-11-09
GitHub AdvisoriesGHSA-3m38-qxxm-8g9g No score
Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline...
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
- Record
GHSA-3m38-qxxm-8g9g- Weakness
- CWE-306
- Updated
- 2026-11-09
NVD No score
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
- Record
CVE-2026-68982- Weakness
- CWE-306
- Updated
- 2026-11-09
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published, references | EUVD | |
| references | CVE List | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-68982 is a vulnerability with no CVSS score yet in Apache Software Foundation Airflow, published November 9, 2026. No source lists public exploit code. No source names a fixed version.