Executive brief
Apache Airflow's Scheduler and API server deserialize exception data from serialized DAG definitions. A malicious DAG author can embed arbitrary Python code in the executor_config field that is executed when the Scheduler loads the DAG or when an authenticated user accesses the DAG via the API. The Scheduler and API server have full access to the metadata database and JWT signing credentials, making this a severe compromise vector that bypasses Airflow's security model.
Affected products
- Apache Airflow prior to 3.3.1
Timeline
- 2026-08-12: disclosed
- 2026-08-05: patched: PR #68511 merged to main