{"id":"CVE-2026-68982","aliases":["EUVD-2026-119905","GHSA-3m38-qxxm-8g9g"],"status":"published","title":"Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation","description":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2026-11-09T09:55:00Z","modified":"2026-11-09T13:05:04Z","products":[{"vendor":"apache software foundation","product":"apache airflow"}],"references":[{"url":"https://github.com/apache/airflow/pull/71192","tags":["patch"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11981","tags":["related"]},{"url":"https://lists.apache.org/thread.html/7t514l87nhjworv2ns22b8ltxr1f7rhg","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68982"},{"url":"https://github.com/apache/airflow/pull/70927"},{"url":"https://github.com/advisories/GHSA-3m38-qxxm-8g9g"}],"sources":{"cve":[{"id":"CVE-2026-68982","title":"Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation","description":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.","status":"published","published":"2026-11-09T09:55:00.238Z","modified":"2026-11-09T13:05:04.432Z","cwes":["CWE-306"],"updated_at":"2026-11-09T14:33:34.013968Z"}],"euvd":[{"id":"EUVD-2026-119905","description":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.","status":"published","published":"2026-11-09T09:55:00Z","modified":"2026-11-09T13:05:04Z","updated_at":"2026-11-09T15:17:14.840893Z"}],"ghsa":[{"id":"GHSA-3m38-qxxm-8g9g","title":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline...","description":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.","status":"published","published":"2026-11-09T12:31:41Z","modified":"2026-11-09T12:31:47Z","cwes":["CWE-306"],"updated_at":"2026-11-09T12:48:05.483669Z"}],"nvd":[{"id":"CVE-2026-68982","description":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.","status":"published","published":"2026-11-09T10:17:11.123Z","modified":"2026-11-09T13:17:08.62Z","cwes":["CWE-306"],"updated_at":"2026-11-09T16:14:55.674086Z"}]}}