# CVE-2026-96285: Apache Airflow incomplete deserialization check bypass in scheduler

Source: https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-96285 · Severity: info · Published 2026-11-09

Apache Airflow's workflow scheduler processes task parameters, and in version 3.3.1 an incomplete security fix allowed attackers to still trigger arbitrary constructor execution. A task author can craft malicious parameters that will execute code in the scheduler and API server before safety checks can reject them, potentially leading to remote code execution. Organizations using Airflow 3.3.1 must upgrade to 3.4.0 or later.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-96285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96285 being exploited in the wild.

**How severe is CVE-2026-96285?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Airflow 3.3.1.

**Is there a fix for CVE-2026-96285?** Yes: fixed in Apache Airflow 3.4.0 or later. Until then: Upgrade to Apache Airflow 3.4.0 or later. Restrict task definition privileges and limit DAG author access to users who are trusted. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96285 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-96285?** Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache Airflow 3.4.0 or later

Upgrade to Apache Airflow 3.4.0 or later. Restrict task definition privileges and limit DAG author access to users who are trusted.

## Technical details

The vulnerability is an incomplete fix for CVE-2026-67260 where deserialization of `next_kwargs` parameters now checks the result is a dictionary, but performs this check only after reconstructing nested objects via an allow-listed deserializer that includes Airflow's own classes. A DAG author controlling task `next_kwargs` via the task execution API can trigger constructor execution in the scheduler during `awaiting_input` timeout processing and in the API server when serving task instances to workers. No non-default configuration is required for exploitation.

## Affected products

- Apache Airflow 3.3.1

## Timeline

- 2026-11-09: disclosed
- 2026-10-19: patched: Fix merged into Airflow 3.4.0 branch

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/73576](https://github.com/apache/airflow/pull/73576)

## Related threats

- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)
- [Apache Airflow CeleryExecutor callback code execution](https://junglewise.ai/threats/cve-2026-68982-apache-airflow-s-celeryexecutor-ran-callback-workloads)