CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Apache Software Foundation · Apache Airflow
Vendor fix available · Affected: Apache Software Foundation Apache Airflow · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 10 Nov.
- Apache Airflow and Storm updates fix 20 security flawsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.