Apache Airflow: DAG author gains code execution in the scheduler and API server via unrestricted deserialization

Impact

A DAG author could embed a malicious trigger whose serialized form made the scheduler or API server import an arbitrary class path, executing code in those processes. That breaks the boundary Airflow relies on - DAG-author code is supposed to run only in workers, never in the control processes. On a GPU fleet where Airflow drives training and batch inference pipelines, the scheduler process typically holds the connection secrets, Kubernetes credentials and queue access for every tenant pipeline, so one pipeline author reaches jobs and data belonging to all of them. Anyone with write access to the DAG bundle (a shared git repo, an uploaded DAG folder) is effectively an operator of the control plane until this is fixed.

Who can reach it

Any principal who can get a DAG into the deployment's DAG bundle - commit access to the DAG repo or write access to the DAG directory. No Airflow UI authentication is needed beyond that write path; exploitation happens when the scheduler or API server parses the serialized DAG.

What to do

Upgrade apache-airflow to 3.3.0 or later and restart the scheduler and API server; worker restarts follow normally. As defense in depth where DAG authors are not fully trusted, narrow [core] allowed_deserialization_classes to an explicit allowlist - this can be applied by config change and restart without waiting for the version bump. No node drain or reboot is involved.

References

Related entries

• Fortinet FortiClient EMS: Improper access controlCVE-2026-35616 · Fortinet FortiClient EMSCritical
• Fortinet FortiSandbox: OS command injection via crafted HTTP requestsCVE-2026-39808 · Fortinet FortiSandboxCritical
• Linux kernel libceph: unbounded auth key length overflows a fixed-size buffer in process_auth_done()CVE-2026-43304 · Linux kernel libceph (auth key decoding)Critical
• UDS Identity Config: Keycloak authenticator accepts any client_secret, granting service-account tokensCVE-2026-46389 · UDS Identity Config - Keycloak client-kubernetes-secret authenticator (UDS Core Identity)Critical
• VMware Avi Load Balancer: authentication bypass grants network access to the Avi control planeCVE-2026-47865 · VMware Avi Load Balancer (Avi Controller authentication)Critical
• rclone (rcd remote control server): An unauthenticated request to the rclone remote-control server instantiates aCVE-2026-49980 · rclone (rcd remote control server)Critical