CVE-2026-67587: Apache Airflow Task SDK RCE Vulnerability

CVE-2026-67587 Overview

CVE-2026-67587 is an insecure deserialization vulnerability [CWE-502] in Apache Airflow's Task SDK. The Task SDK rebuilds a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is an Airflow class, it passes the default allowed_deserialization_classes allow-list, so tightening that setting does not mitigate the issue. A DAG author who controls a task instance's next_kwargs through the task execution API can trigger an arbitrary module import inside the scheduler process. The import occurs when the scheduler's awaiting_input timeout sweep deserializes that value. The sweep runs unconditionally, requiring no non-default configuration.

Critical Impact
An authenticated DAG author can cause the Apache Airflow scheduler to import arbitrary Python modules, enabling code execution inside the scheduler process.

Affected Products

Apache Airflow versions 3.3.0 up to (but not including) 3.3.1
Apache Airflow Task SDK (SyncCallback deserialization code path)
Apache Airflow Scheduler component (awaiting_input timeout sweep)

Discovery Timeline

2026-08-12 - CVE-2026-67587 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-67587

Vulnerability Analysis

Apache Airflow's Task SDK stores callback references as serialized data containing a module path. When the scheduler reconstructs a Callback object, it re-runs the constructor, which imports the module named in the serialized payload. Python module imports execute top-level code in the target module, so an attacker-controlled module path yields arbitrary code execution inside the scheduler process.

The allowed_deserialization_classes allow-list does not stop this attack. SyncCallback is a legitimate Airflow class and remains on the default allow-list. Restricting the allow-list further has no effect because the class itself is not the gadget — the module import triggered by its constructor is the gadget.

This code path is distinct from those covered by CVE-2026-58076 and CVE-2026-67260. Applying the fixes for those CVEs does not remediate CVE-2026-67587.

Root Cause

The root cause is unsafe reconstruction of serialized objects by re-invoking a constructor whose side effect is a dynamic import of an attacker-controlled path. The design conflates deserialization with module loading, so any user who can write to fields consumed by the deserializer can force imports of arbitrary modules.

Attack Vector

A DAG author controls a task instance's next_kwargs through the task execution API. The attacker embeds a crafted SyncCallback reference pointing at a module path they control. The scheduler's awaiting_input timeout sweep runs unconditionally and deserializes next_kwargs, which triggers the module import inside the scheduler process. Because the sweep runs by default, no unusual configuration is needed for exploitation.

Versions before 3.3.0 are not vulnerable. The SyncCallback class existed earlier, but the scheduler sweep that reaches it was introduced in 3.3.0. See the GitHub Pull Request and the Apache Mailing List Discussion for technical details.

Detection Methods for CVE-2026-67587

Indicators of Compromise

Unexpected Python module imports inside the Airflow scheduler process, particularly modules outside the standard Airflow package tree.
Task instances whose next_kwargs reference SyncCallback with unusual or non-standard module paths.
Scheduler log entries showing deserialization of Callback objects during awaiting_input timeout sweeps followed by unfamiliar module load activity.

Detection Strategies

Audit the Airflow metadata database for task instances where next_kwargs contains serialized SyncCallback entries pointing to unexpected import paths.
Instrument the scheduler process to log every dynamic import triggered during deserialization and compare against an allow-list of expected modules.
Correlate DAG author activity from the task execution API with subsequent scheduler process behavior, including new child processes or outbound network connections.

Monitoring Recommendations

Monitor scheduler process telemetry for spawning of shells, interpreters, or network utilities that fall outside baseline behavior.
Track changes to files, environment variables, and credentials accessible to the scheduler service account.
Alert on newly deployed DAGs or task modifications that inject next_kwargs values referencing callback classes.

How to Mitigate CVE-2026-67587

Immediate Actions Required

Upgrade Apache Airflow to version 3.3.1 or later, which contains the fix for this deserialization path.
Restrict DAG authoring privileges to trusted operators until the upgrade is applied.
Review the DAG catalog and metadata database for any pre-existing task instances containing suspicious next_kwargs payloads.

Patch Information

The fix is delivered in apache-airflow 3.3.1. Details of the code change are available in the upstream GitHub Pull Request. Note that fixes for CVE-2026-58076 and CVE-2026-67260 do not address this vulnerability; the 3.3.1 upgrade is required.

Workarounds

No configuration-only workaround exists. Tightening allowed_deserialization_classes does not block this gadget because SyncCallback is an Airflow-native class.
If immediate upgrade is not possible, remove or disable DAG author access to the task execution API endpoints that populate next_kwargs.
Isolate the scheduler process with strict egress network controls and a minimal file system permission set to limit post-exploitation impact.

bash

# Configuration example: upgrade Apache Airflow to the fixed release
pip install --upgrade "apache-airflow>=3.3.1"

# Verify installed version
airflow version