CVE-2026-111395

UNKNOWN 0.0

Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. Users are advised to upgrade to apache-airflow 3.4.0 or later.

CWE	CWE-502
Vendor	apache software foundation
Product	apache airflow
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow

3.2.0 < 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/74834 lists.apache.org: https://lists.apache.org/thread.html/qb4qxr40s0q6w9b9t5mfw5qf53pg97p3 openwall.com: http://www.openwall.com/lists/oss-security/2026/11/09/13

Credits

Jarek Potiuk Jarek Potiuk