Description

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-12T16:17:14.813Z",
  "pubdate": "2026-08-12T16:17:14.813Z",
  "executiveSummary": "An insecure deserialization vulnerability exists in Apache Airflow version 3.3.0, specifically within the newly introduced awaiting_input task state and its associated scheduler sweep mechanism. The vulnerability allows a malicious Dag author who controls the task instance's next_kwargs value through the task execution API to achieve arbitrary module import and object instantiation within the scheduler process, or alternatively cause a denial of service by terminating the scheduler job.\nThe impact of this flaw is severe, potentially leading to remote code execution within the context of the scheduler daemon. The affected systems include Apache Airflow 3.3.0. Versions prior to 3.3.0 are not affected because human-in-the-loop tasks were handled via the triggerer rather than the scheduler. No non-default configuration is required for exposure, as the scheduler sweep executes unconditionally every 15 seconds, and the default allowed_deserialization_classes setting fails to protect this specific code path.\nAttacker capabilities require Dag author privileges to manipulate the next_kwargs parameter via the task execution API. Exploitation requires no prior authentication if the task execution API is accessible, leveraging internal scheduler routines to execute arbitrary logic.",
  "technicalDetails": "The root cause of the vulnerability lies in the implementation of the awaiting_input task state introduced in Apache Airflow 3.3.0. When human-in-the-loop tasks transition to this state, the scheduler process periodically sweeps and processes them. During this sweep operation, the scheduler deserializes the task instance's next_kwargs attribute without applying an adequate allow-list or enforcing the default allowed_deserialization_classes security controls.\nThe vulnerable component is the scheduler process handling the awaiting_input task state sweep mechanism. Affected versions are strictly limited to Apache Airflow 3.3.0.\nThe attack flow proceeds as follows: First, a malicious Dag author interacts with the task execution API to set or modify the next_kwargs parameter associated with a task instance. Second, the task transitions to or is placed in the awaiting_input state. Third, the scheduler executes its unconditional 15-second sweep cycle, which targets the awaiting_input task instances. Fourth, the scheduler automatically deserializes the untrusted next_kwargs data without validation. Fifth, this lack of validation triggers arbitrary module imports and object instantiation inside the context of the running scheduler process, or crashes the scheduler job to cause a denial of service.\nPrivilege requirements involve having Dag author access to supply malicious input via the task execution API. The vulnerability is triggered internally by the scheduler daemon without requiring external network exposure beyond the standard API interaction points, executing payloads with the privileges of the scheduler process."
}