CVE-2026-67260 Overview
CVE-2026-67260 is an insecure deserialization vulnerability [CWE-502] in Apache Airflow 3.3.0. The flaw affects the scheduler's handling of human-in-the-loop (HITL) tasks, which were moved from the triggerer to a new awaiting_input task state swept by the scheduler.
The scheduler sweep deserializes the task instance's next_kwargs field without applying an allow-list. A Dag author who controls that value through the task execution API can trigger arbitrary module imports and object instantiation inside the scheduler process, or terminate the scheduler job entirely.
Critical Impact
The vulnerable sweep runs unconditionally every 15 seconds, and the default allowed_deserialization_classes setting does not cover this code path. No non-default configuration is required for exploitation.
Affected Products
- Apache Airflow 3.3.0
- Deployments that previously applied the fix for CVE-2026-58076 (must still upgrade)
- Versions before 3.3.0 are not affected (HITL tasks deferred onto the triggerer)
Discovery Timeline
- 2026-08-12 - CVE-2026-67260 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-67260
Vulnerability Analysis
Apache Airflow 3.3.0 introduced a new architecture for human-in-the-loop tasks. Instead of deferring these tasks onto the triggerer, they are placed into an awaiting_input task state that the scheduler sweeps periodically.
During each sweep, the scheduler deserializes the task instance's next_kwargs field. This deserialization occurs without an allow-list, and the default allowed_deserialization_classes configuration setting does not apply to this code path. A Dag author who can write to next_kwargs through the task execution API can therefore control the objects that get instantiated inside the scheduler process.
This is a distinct code path from CVE-2026-58076, which addressed the same unguarded exception-node deserialization reached from another location. Operators who patched CVE-2026-58076 remain exposed until they upgrade for this issue.
Root Cause
The root cause is missing input validation on serialized data reaching the scheduler [CWE-502]. The next_kwargs field is treated as trusted input during the awaiting_input sweep, even though its contents originate from Dag authors via the task execution API. The default deserialization allow-list does not cover this new code path introduced in 3.3.0.
Attack Vector
An authenticated Dag author submits a crafted next_kwargs payload through the task execution API. The scheduler picks up the payload during its next 15-second sweep of awaiting_input tasks and deserializes it. Deserialization results in arbitrary Python module import and object instantiation inside the scheduler process, or causes the scheduler job to terminate.
Refer to the Apache Airflow pull request 70685 and the Apache mailing list advisory for technical details of the affected code path.
Detection Methods for CVE-2026-67260
Indicators of Compromise
- Unexpected scheduler process crashes or restarts occurring on approximately 15-second cadences aligned with the awaiting_input sweep.
- Unusual Python module imports or child processes originating from the Airflow scheduler process.
- Task instances entering awaiting_input state with anomalous or non-standard next_kwargs payloads.
Detection Strategies
- Review scheduler logs for deserialization errors, unhandled exceptions, or unexpected class instantiation during HITL task processing.
- Audit the task execution API for calls that write large or obfuscated next_kwargs values from non-privileged Dag authors.
- Correlate scheduler termination events with recent Dag deployments or task execution API activity.
Monitoring Recommendations
- Enable verbose logging on the Airflow scheduler and forward logs to a central SIEM for retention and correlation.
- Monitor process creation and outbound network connections from the scheduler host to identify post-exploitation activity.
- Track Airflow version and configuration inventory to confirm all instances of 3.3.0 have been upgraded.
How to Mitigate CVE-2026-67260
Immediate Actions Required
- Upgrade Apache Airflow to version 3.3.1 or later on all scheduler nodes.
- Restrict Dag authoring privileges and access to the task execution API to trusted users only.
- Audit existing Dags and task instances for suspicious next_kwargs values prior to upgrade.
Patch Information
The fix is included in Apache Airflow 3.3.1. See Apache Airflow PR #70685 for the code change and the Apache announcement thread for release details. Deployments that previously applied the fix for CVE-2026-58076 must also upgrade, because this issue affects a different code path.
Workarounds
- No official workaround eliminates the risk; upgrading to 3.3.1 is required.
- Where immediate upgrade is not possible, revoke Dag authoring permissions from untrusted users and disable HITL task usage until patching is complete.
- Isolate the scheduler on a segmented network to limit blast radius from arbitrary code execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
