Apache Airflow and Storm updates fix 20 security flaws

The Apache Software Foundation disclosed 20 security flaws on 9 November 2026, of which 18 affect Apache Airflow and two affect Apache Storm. The issues range from secret leakage to code execution on Celery workers, with five rated high severity. Airflow 3.4.0 addresses deserialization, authorisation and secret-masking bugs, including one that could let anyone with access to the Celery broker enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker.

In Storm, two flaws enable unsafe deserialization and insecure class loading. There are currently no confirmed exploitations in the wild for these 20 flaws, and no public PoCs have been verified for them.

Affected versions are Apache Airflow prior to 3.4.0 and Apache Storm releases before the fixed 3.2.0 line.

Notable CVEs include CVE-2026-68982 (Airflow CeleryExecutor deserialization/authentication), CVE-2026-86829 (XCom data deserialisation by a Dag author), CVE-2026-82337 (scheduler/API server class construction), CVE-2026-76185 (multi-team secret reads), CVE-2026-107474 (cleartext Apprise credentials in the connections API), CVE-2026-82436 (Storm stateful bolt checkpoint deserialisation with Kryo), and CVE-2026-82440 (unrestricted scheduler strategy class naming).

Five of the flaws are high severity, with others rated medium or low, and no CVSS scores are published by the report. To mitigate, Apache recommends upgrading to Airflow 3.4.0 and Storm 3.2.0, tightening Celery broker access, disabling load_examples in production, and rotating secrets if they appeared in audit logs prior to patching.