Apache Airflow 3.3.0: Dag author reaches arbitrary imports in the scheduler via next_kwargs deserialization

Impact

Airflow 3.3.0 moved human-in-the-loop tasks into an awaiting_input state that the scheduler sweeps every 15 seconds, and that sweep deserializes the task instance's next_kwargs with no allow-list. A Dag author controls that value through the task execution API, so they can force an arbitrary module import and object instantiation inside the scheduler process, or simply terminate the scheduler job. This needs no non-default configuration — the sweep always runs, and allowed_deserialization_classes does not cover the path. On an ML platform the scheduler usually holds the broadest credentials in the pipeline stack (cluster access, object storage, registries), so a Dag author reaches well past their own pipeline; killing the scheduler stalls every training and batch-inference Dag on the fleet at once.

Who can reach it

Anyone who can author or edit a Dag, or otherwise set a task instance's next_kwargs through the task execution API. Only Airflow 3.3.0 is affected — earlier versions deferred these tasks onto the triggerer instead.

What to do

Upgrade to apache-airflow 3.3.1 or later and restart the scheduler (plus API server and workers as your deployment requires); no node reboot. Having already applied the fix for CVE-2026-58076 is not sufficient — this is a separate code path reaching the same unguarded deserialization.

References

Related entries

• Jenkins: session is not rotated on remember-me login, allowing session fixation against any userCVE-2026-84652 · Jenkins core (remember-me authentication, session handling)High
• Renovate gomod manager: shell metacharacters in a dependency name run commands as the Renovate userCVE-2026-88885 · Renovate (gomod manager, import-path update with binarySource=docker)High
• Renovate Mix manager: unescaped organization parameter lets a package name run commands as the Renovate userCVE-2026-88888 · Renovate (Mix manager, private dependency organization parameter)High
• HPE iLO4 / iLO5: Remote code execution on the management controllerCVE-2018-7078 · HPE iLO4 / iLO5High
• HPE iLO3/4/5: Arbitrary code execution on the iLOCVE-2018-7105 · HPE iLO3/4/5High
• NetApp ONTAP Select Deploy administration utility (privilege escalation): An administrative user of the Deploy utilityCVE-2019-17272 · NetApp ONTAP Select Deploy administration utility (privilege escalation)High