{"id":"CVE-2026-96285","aliases":["EUVD-2026-119900","GHSA-h6xc-w3fp-2wwj"],"status":"published","title":"Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors","description":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-11-09T09:47:22Z","modified":"2026-11-09T12:31:46Z","products":[{"vendor":"apache software foundation","product":"apache airflow"}],"references":[{"url":"https://github.com/apache/airflow/pull/73576","tags":["patch"]},{"url":"https://github.com/apache/airflow/pull/73577","tags":["patch"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67260","tags":["related"]},{"url":"https://lists.apache.org/thread.html/5grvgsjw0c47q0pko8vnfy35drj4jyck","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96285"},{"url":"https://github.com/advisories/GHSA-h6xc-w3fp-2wwj"}],"sources":{"cve":[{"id":"CVE-2026-96285","title":"Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors","description":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.","status":"published","published":"2026-11-09T09:47:22.524Z","modified":"2026-11-09T09:47:22.524Z","cwes":["CWE-502"],"updated_at":"2026-11-09T10:32:46.549431Z"}],"euvd":[{"id":"EUVD-2026-119900","description":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.","status":"published","published":"2026-11-09T09:47:22Z","modified":"2026-11-09T09:47:22Z","updated_at":"2026-11-09T15:17:15.365583Z"}],"ghsa":[{"id":"GHSA-h6xc-w3fp-2wwj","title":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded ...","description":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.","status":"published","published":"2026-11-09T12:31:42Z","modified":"2026-11-09T12:31:46Z","cwes":["CWE-502"],"updated_at":"2026-11-09T12:48:05.483669Z"}],"nvd":[{"id":"CVE-2026-96285","description":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.","status":"published","published":"2026-11-09T10:17:16.203Z","modified":"2026-11-09T10:17:16.203Z","cwes":["CWE-502"],"updated_at":"2026-11-09T12:13:58.438772Z"}]}}