Critical vulnerability
Critical remote code execution in Apache Airflow (CVE-2026-68982)
Remote code execution in Apache Airflow · Servers and applications
CVE-2026-68982
Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
- Severity
- Critical 9.8
- Published
- 9 Nov 2026
- Fixed in
- 3.4.0
- Exploit chance
- 0.5% in the next 30 daysHigher than 40% of CVEs. EPSS by FIRST, 13 Nov 2026
- Weakness
- Missing authentication (CWE-306)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
| Software | Affected versions |
|---|---|
| Apache AirflowServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-68982
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.