CVE-2026-45360 PUBLISHED

Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Assigner: apache
Reserved: 11.05.2026 Published: 01.06.2026 Updated: 01.06.2026

Apache Airflow's scheduler-side deadline-reference decoder (SerializedCustomReference.deserialize_reference) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom DeadlineReference whose serialized form named an attacker-controlled module path, causing the scheduler to import_string(...) and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to apache-airflow 3.2.2 or later.

Product Status

Vendor Apache Software Foundation
Product Apache Airflow
Versions Default: unaffected
  • affected from 0 to 3.2.2 (excl.)

Credits

  • Jarek Potiuk remediation developer

References

Problem Types

  • CWE-502: Deserialization of Untrusted Data CWE