# CVE-2026-111395: Apache Airflow reserved serialization key injection in DAG run conf

Source: https://junglewise.ai/threats/cve-2026-111395-apache-airflow-did-not-reject-reserved-serialization-keys-inside  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-111395 · Severity: info · Published 2026-11-09

Apache Airflow is a workflow orchestration platform that schedules and monitors data pipelines. A user with permission to trigger a DAG can inject specially crafted configuration that could crash the scheduler repeatedly or trigger unintended object construction in the Deadline Alert callback handler. This could lead to denial of service or potentially arbitrary code execution depending on the objects constructed.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111395 being exploited in the wild.

**How severe is CVE-2026-111395?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Airflow before 3.4.0.

**Is there a fix for CVE-2026-111395?** Yes: fixed in apache-airflow 3.4.0. Until then: Restrict DAG trigger permissions to trusted users only; disable Deadline Alert callbacks with asynchronous execution if the feature cannot be immediately upgraded. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111395 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111395?** Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in apache-airflow 3.4.0

Restrict DAG trigger permissions to trusted users only; disable Deadline Alert callbacks with asynchronous execution if the feature cannot be immediately upgraded.

## Technical details

The vulnerability exists because Airflow's DAG run `conf` parameter did not reject reserved serialization keys (__classname__, __version__, __data__, __cache__, __type__, __source__, __var__) that are used by the serialization format. An authenticated user with DAG trigger permission can supply a conf that, when processed by Deadline Alert callbacks with asynchronous execution, gets deserialized into potentially malicious objects. The fix validates and rejects such keys at all conf entry points (REST API trigger endpoints, backfill API, Execution API) and prevents queuing of triggerer callbacks containing reserved keys.

## Affected products

- Apache Airflow before 3.4.0

## Timeline

- 2026-11-09: disclosed
- 2026-10-19: patched: Fix merged in PR #74834 to apache/airflow main branch, targeted for 3.4.0 release

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/74834](https://github.com/apache/airflow/pull/74834)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)