Executive brief
Apache Airflow's Kafka provider for versions 1.15.0 to 1.99.x allows users with Kafka connection configuration privileges to execute arbitrary code in the scheduler process (the control plane). The vulnerability exploits unsafe handling of callback functions stored in connection credentials. For deployments with Kafka event producers enabled, this gives attackers direct control over critical infrastructure that would normally be restricted to code execution only on worker nodes.
Technical details
The Apache Kafka provider resolves dotted-path strings from a Kafka connection's `extra` field into Python callables via `import_string` without any allowlist or validation, then passes them to the confluent-kafka client which invokes them. When the Kafka event producer is enabled (via `dag_run_events_enabled` or `task_instance_events_enabled`, both disabled by default), the client is built inside the scheduler process. An attacker with connection-editing privileges can specify malicious callbacks (e.g., `os.system`) that are loaded and executed with scheduler privileges. The attack requires no network access or additional authentication beyond the ability to modify Kafka connections. Patch availability: upgrade to apache-airflow-providers-apache-kafka 2.0.0 or later, which adds an allowlist configuration option.
Affected products
- Apache Airflow Apache Kafka provider 1.15.0 before 2.0.0
Timeline
- 2026-09-16: disclosed
- 2026-09-08: patched: Fix merged in PR #72208