CVE-2026-68982

UNKNOWN 0.0

Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.

CWE	CWE-306
Vendor	apache software foundation
Product	apache airflow
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow

0 < 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/71192 cve.org: https://www.cve.org/CVERecord?id=CVE-2020-11981 lists.apache.org: https://lists.apache.org/thread.html/7t514l87nhjworv2ns22b8ltxr1f7rhg

Credits

Or Sahar (Reflectiz) Sean Ghaeli