CVE-2026-86792: Apache Airflow Kafka Provider RCE Vulnerability

CVE-2026-86792 Overview

CVE-2026-86792 affects the Apache Airflow Apache Kafka provider from version 1.15.0 up to but not including 2.0.0. The provider resolves dotted-path strings from a Kafka connection's extra field into Python callables using import_string without an allowlist. Those callables are passed to the confluent-kafka client, which invokes them inside the scheduler process when the Kafka event producer is enabled. A user with only connection-edit privileges gains arbitrary code execution in the Airflow control plane, breaking the documented Airflow security boundary that restricts such users to worker-side execution. The flaw is classified under CWE-470: Unsafe Reflection.

Critical Impact
A low-privileged connection editor can execute arbitrary Python inside the Airflow scheduler, compromising the control plane of any deployment that enables dag_run_events_enabled or task_instance_events_enabled on plain brokers or Amazon MSK.

Affected Products

apache-airflow-providers-apache-kafka versions 1.15.0 through versions prior to 2.0.0
Airflow deployments using plain Kafka brokers with the event producer enabled
Airflow deployments using Amazon Managed Streaming for Apache Kafka (MSK) with the event producer enabled

Discovery Timeline

2026-09-15 - Public advisory posted to the OpenWall OSS Security list
2026-09-16 - CVE-2026-86792 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-86792

Vulnerability Analysis

The Apache Kafka provider reads user-supplied dotted paths from the Kafka connection's extra field and hands them to Airflow's import_string helper. import_string performs unrestricted module import and attribute resolution, returning any callable the string points to. That callable is then registered with the confluent-kafka client, which invokes it during client construction. Because the Kafka event producer is instantiated inside the Airflow scheduler when dag_run_events_enabled or task_instance_events_enabled is set, invocation happens in the control plane rather than on a worker.

The issue breaks a specific Airflow trust boundary. The Airflow security model treats users who can edit connections as capable of running code on workers, which is expected behavior. It does not grant those users execution on the scheduler. This bug erases that distinction. Deployments using Google Managed Kafka are not affected, because that integration overwrites any user-supplied oauth_cb before it reaches the client.

Root Cause

The root cause is unsafe reflection. import_string is invoked on attacker-controlled input with no allowlist of permitted modules or callables. Any importable Python object in the scheduler's environment becomes reachable, including os.system, subprocess.Popen, or arbitrary attacker-planted modules.

Attack Vector

An authenticated user with the can_edit permission on Airflow connections modifies a Kafka connection and sets a callback field in extra, for example oauth_cb, to a dotted path resolving to a malicious callable. When the scheduler builds the Kafka producer for the next DAG run or task instance event, import_string resolves the path and confluent-kafka invokes it. Code executes as the scheduler process user, granting access to the metadata database, Fernet keys, and other connection secrets. Refer to the upstream fix in pull request 72208 for the corrected resolution logic.

Detection Methods for CVE-2026-86792

Indicators of Compromise

Kafka connection extra fields containing dotted-path values for oauth_cb, error_cb, throttle_cb, stats_cb, or on_delivery that reference modules outside the standard confluent-kafka namespace.
Scheduler process spawning unexpected child processes such as sh, bash, python, curl, or wget shortly after a DAG run or task instance state change.
Unexpected outbound network connections originating from the Airflow scheduler host.

Detection Strategies

Audit the Airflow metadata database connection table for any Kafka connections whose extra JSON contains callback keys pointing to non-vendor Python paths.
Enable Airflow audit logging for connection create and update events and alert on modifications to connections of type kafka.
Correlate scheduler process telemetry with connection edit events to surface code paths that only fire after a connection change.

Monitoring Recommendations

Monitor the scheduler host for process lineage anomalies where the Airflow scheduler is the parent of shell interpreters or network utilities.
Track file system writes and outbound DNS or HTTP from the scheduler user account and alert on deviations from baseline.
Review Airflow configuration for dag_run_events_enabled and task_instance_events_enabled and log any change to either setting.

How to Mitigate CVE-2026-86792

Immediate Actions Required

Upgrade apache-airflow-providers-apache-kafka to version 2.0.0 or later, which introduces an allowlist configuration for connection-string callbacks.
If upgrading is not immediately possible, disable dag_run_events_enabled and task_instance_events_enabled to prevent the scheduler from constructing the Kafka client.
Review and restrict the can_edit permission on Airflow connections to trusted administrators only.
Audit existing Kafka connections and remove any callback paths that were not set by an authorized operator.

Patch Information

The fix is available in apache-airflow-providers-apache-kafka 2.0.0. The patched release adds an explicit allowlist that import_string is checked against before any callable is passed to confluent-kafka. See the Apache mailing list announcement and the GitHub pull request for change details.

Workarounds

Keep both dag_run_events_enabled and task_instance_events_enabled at their default disabled state until the provider is upgraded.
Migrate Kafka connections to Google Managed Kafka where feasible, since that code path overwrites user-supplied oauth_cb values and is not affected.
Enforce Airflow role-based access control so that only vetted administrators hold connection-edit rights on Kafka connections.

bash

# Upgrade the affected provider to the patched release
pip install --upgrade 'apache-airflow-providers-apache-kafka>=2.0.0'

# Interim mitigation: ensure the Kafka event producer is disabled
export AIRFLOW__KAFKA__DAG_RUN_EVENTS_ENABLED=False
export AIRFLOW__KAFKA__TASK_INSTANCE_EVENTS_ENABLED=False