Apache Airflow: DAG-author-controlled class path imported by the scheduler with a live DB session

Impact

Airflow often drives the batch and training pipelines that feed a GPU fleet, and its scheduler is the one process with direct database access. The deadline-reference decoder called import_string on a class path taken from DAG-author-controlled serialized state with no allowlist, then instantiated that class with a live SQLAlchemy session attached. A DAG author who is less trusted than the scheduler - the normal arrangement in a shared cluster, and the default on single-host deployments where the DAG bundle is importable from the scheduler process - gets code execution in the scheduler with metadata-database access, which means control over what jobs run on the fleet and over the connections and credentials Airflow stores. The record does not claim an impact beyond the scheduler process.

Who can reach it

A DAG author whose bundle is importable by the scheduler. Requires the ability to add or modify DAG code, not network access to the webserver.

What to do

Upgrade apache-airflow to 3.2.2 or later and restart the scheduler. On deployments where DAG authors are untrusted, also review which connections and variables the metadata database holds, since scheduler code execution exposes them. No mitigation short of the upgrade is given in the advisory.

References

Related entries

• Apache Airflow 3.3.0: Dag author reaches arbitrary imports in the scheduler via next_kwargs deserializationCVE-2026-67260 · Apache Airflow scheduler (awaiting_input sweep, next_kwargs deserialization)High
• Jenkins: session is not rotated on remember-me login, allowing session fixation against any userCVE-2026-84652 · Jenkins core (remember-me authentication, session handling)High
• Renovate gomod manager: shell metacharacters in a dependency name run commands as the Renovate userCVE-2026-88885 · Renovate (gomod manager, import-path update with binarySource=docker)High
• Renovate Mix manager: unescaped organization parameter lets a package name run commands as the Renovate userCVE-2026-88888 · Renovate (Mix manager, private dependency organization parameter)High
• GitLab EE: injected AI conversation context causes agent commands to run as another userCVE-2026-96893 · GitLab EE (AI agent conversation context construction)High
• HPE iLO4 / iLO5: Remote code execution on the management controllerCVE-2018-7078 · HPE iLO4 / iLO5High