CVE-2026-58076 Overview
CVE-2026-58076 is an insecure deserialization vulnerability [CWE-502] in Apache Airflow's serialization layer. The deserializer reconstructs exception nodes by calling import_string() on a class name pulled from the serialized blob, then instantiates it with arguments from the same blob. No restriction limits which class can be imported, allowing a Dag author to trigger arbitrary callable execution such as subprocess.check_output or builtins.eval. The code executes in the Scheduler and the API server, both of which the Airflow security model states must never run Dag-author code. Both components hold the metadata database credentials and the JWT signing secret. No non-default configuration is required for exploitation.
Critical Impact
A malicious Dag author can achieve arbitrary code execution inside the Airflow Scheduler and API server on any authenticated read of the Dag, compromising database credentials and JWT signing keys.
Affected Products
- Apache Airflow versions prior to 3.3.1
- Deployments previously patched only for CVE-2026-33264 (still vulnerable through the exception branch)
- Airflow Scheduler and API server components
Discovery Timeline
- 2026-08-12 - CVE-2026-58076 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-58076
Vulnerability Analysis
Apache Airflow's serialization layer supports reconstructing exception objects from serialized Dag data. During reconstruction, the deserializer reads a class name string from the serialized blob and passes it to import_string(). The resulting class is then instantiated with constructor arguments taken from the same untrusted blob. No allowlist or type check restricts what import_string() can resolve, so any importable Python callable becomes a viable target.
An operator's executor_config field reaches this vulnerable code path. A Dag author can craft an executor_config value that, when deserialized, imports and invokes an arbitrary callable such as subprocess.check_output or builtins.eval. Deserialization occurs in the Scheduler as part of its normal Dag reconstruction loop, requiring no incoming request, and in the API server on any authenticated read of Dag details such as GET /api/v2/dags/{dag_id}/details.
This is a distinct sink from CVE-2026-33264, which covered only the trigger branch of the same deserializer. Deployments patched only for that earlier advisory remain vulnerable through the exception branch.
Root Cause
The root cause is unrestricted class resolution during exception deserialization. The serializer trusts the class name and arguments in the serialized payload without validating that the resolved class is a subclass of BaseException. This turns a data-loading operation into an arbitrary code execution primitive.
Attack Vector
An attacker with Dag authoring privileges places a malicious payload in an operator's executor_config. Once the Dag is serialized and later reconstructed by the Scheduler or read via the API server, the payload triggers import and invocation of the attacker-chosen callable. Execution occurs in components that hold the metadata database credentials and the JWT signing secret, enabling full compromise of the Airflow control plane. See the GitHub Pull Request and Apache Mailing List Thread for technical details.
Detection Methods for CVE-2026-58076
Indicators of Compromise
- Unexpected child processes spawned by the Airflow Scheduler or API server process tree, particularly python, sh, or subprocess-invoked binaries.
- Outbound network connections originating from Scheduler or API server hosts to unfamiliar destinations.
- Unauthorized reads or exports of the Airflow metadata database and JWT signing secret material.
Detection Strategies
- Inspect serialized Dag records in the metadata database for executor_config values referencing non-exception classes such as subprocess.check_output or builtins.eval.
- Audit Dag source code for executor_config entries containing serialized objects with unusual __class__ or import-string references.
- Monitor authenticated calls to GET /api/v2/dags/{dag_id}/details correlated with anomalous process activity on the API server.
Monitoring Recommendations
- Enable process-lineage telemetry on Scheduler and API server hosts and alert on any non-Airflow binary execution.
- Log and review all Dag write operations, including changes to executor_config, from any user account.
- Track access to files or environment variables containing the metadata database URI and JWT signing key.
How to Mitigate CVE-2026-58076
Immediate Actions Required
- Upgrade Apache Airflow to version 3.3.1 or later, which restricts the imported class to a subclass of BaseException.
- Re-upgrade even if CVE-2026-33264 was previously patched, as that fix does not cover the exception branch.
- Rotate the metadata database credentials and JWT signing secret on any deployment that may have executed untrusted Dag content.
- Review all Dag authors' access and remove any accounts that should not have Dag write permissions.
Patch Information
Apache Airflow 3.3.1 restricts the class resolved by import_string() in the exception deserialization branch to subclasses of BaseException, closing the arbitrary-callable sink. The fix is delivered in the GitHub Pull Request referenced in the advisory. See the related CVE-2026-33264 Record for the previously patched trigger branch.
Workarounds
- Restrict Dag authoring to a small, trusted set of accounts and enforce mandatory code review of all Dag submissions.
- Isolate the Scheduler and API server on network segments with strict egress controls to limit post-exploitation impact.
- Block or filter serialized executor_config values that reference classes outside the BaseException hierarchy until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
