Apache Airflow: incomplete CVE-2026-67260 fix still lets next_kwargs run constructors in the scheduler

Impact

The 3.3.1 fix for CVE-2026-67260 checks that the decoded next_kwargs is a dictionary, but only after deserializing the whole stored payload. Deserialization rebuilds nested objects of allow-listed classes, which include Airflow's own classes by default, and runs their constructors before the check can reject the value. A Dag author controls next_kwargs through the task execution API, so they can still trigger constructor execution in the scheduler (during the awaiting_input timeout sweep) and in the API server (when the task instance is served to a worker on an older Execution API version). No non-default configuration is required.

Who can reach it

A Dag author who can run tasks, acting through the task execution API. Authentication (Dag deployment rights) is required. Only versions 3.3.0 and later are affected.

What to do

Upgrade to apache-airflow 3.4.0 or later and restart the scheduler and API server. Deployments that moved to 3.3.1 for CVE-2026-67260 are still affected and must upgrade again. Versions before 3.3.0 are not affected.

References

Related entries

• Linux kernel nfsd: NFSEXP_PNFS not checked when exports are configured over netlinkCVE-2026-98250 · Linux kernel nfsd (NFSEXP_PNFS check in the netlink export codepath)Unscored
• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-004-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-001-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored
• PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolationNCVD-2019-005-pcie-address-translation-service · PCIe Address Translation Services on hosts using an IOMMU/SMMU for device isolation - affects any DMA-capable…Unscored