Executive brief
Apache Airflow, a platform used to programmatically author and schedule workflows, is vulnerable to a security flaw in how it handles custom deadline references. An attacker with the ability to author workflow files (DAGs) could execute unauthorized code within the Airflow scheduler process. This could lead to full system compromise or unauthorized access to the underlying database, particularly in environments where workflow authors are not fully trusted.
Technical details
The vulnerability exists in the `SerializedCustomReference.deserialize_reference` component of Apache Airflow's scheduler. The decoder imported and dispatched arbitrary class paths from serialized state provided by DAG authors without using an allowlist or plugin-registry gate. By embedding a custom `DeadlineReference` with a malicious module path, an attacker can trigger the scheduler to use `import_string()` to instantiate an arbitrary class. This occurs with a live SQLAlchemy session attached, potentially allowing for remote code execution or database manipulation. The issue is most prevalent in single-host deployments where the scheduler can import the DAG bundle. The vulnerability is fixed in version 3.2.2 by requiring custom deadline references to be registered via the AirflowPlugin registry.
Affected products
- Apache Software Foundation Apache Airflow < 3.2.2
Timeline
- 2026-05-11: other: Fix pull request opened
- 2026-05-18: patched: Fix merged into main branch
- 2026-05-31: disclosed: Mailing list announcement
- 2026-06-01: advisory: GitHub Advisory and NVD publication