A critical missing-authentication flaw in Apache Airflow lets attackers run code on Celery workers without any Airflow credentials. Tracked as CVE-2026-68982 , the bug is classified as CWE-306 and affects Airflow versions before 3.4.0 that use CeleryExecutor.
Anyone who can write to the Celery broker can make a worker run any Python function it can import, with arguments the attacker chooses.
Security researcher Or Sahar of Reflectiz found the issue. He confirmed it on Airflow 3.2.1 and 3.3.0 in Docker Compose labs using CeleryExecutor, a Redis broker, and a PostgreSQL backend. Airflow has had several security problems in recent months, but this one needs no login at all.
Airflow gives workers three ways to receive instructions. The web UI and REST API reject users without credentials. ExecuteTask messages on the broker carry a signed token, which the Execution API validates before the task runs. ExecuteCallback messages on the same broker get no check.
ExecuteCallback was added for synchronous Deadline Alert callbacks, which run a function when a DAG run misses its deadline. The scheduler sends the callback to a worker over the broker, and the worker imports and calls the configured function. Because the broker never authenticates the message, an attacker can forge it and name their own function.
The execute_workload task turns any JSON body from the broker into a typed object. There is no signature, HMAC, or broker-side access control. The callback message has a token field, but neither execute_callback_workload() in 3.2.1 nor supervise_callback() and CallbackSubprocess in 3.3.0 verify it.
The worker reads path and kwargs from the message, loads the function with import_module and getattr, and calls it at once. That reaches any importable module, including os, subprocess, and provider Notifier classes.
The feature is documented as experimental, but that does not limit exposure. The handling registers on every CeleryExecutor worker once the Celery provider loads. Earlier research on Airflow credential leaks shows how much sensitive data these workers can hold.
The attacker forges a workload with type set to ExecuteCallback and an empty token. The callback object uses fetch_method import_path and sets path to os.system. Its kwargs hold a command such as touch /tmp/pwned_by_broker_callback. The attacker sends it with Celery’s send_task(“execute_workload”, …) to a broker such as redis:// :6379/0.
The attack needs no JWT, DAG, DagRun, or scheduler. Airflow’s API still reported zero DAGs and zero DagRuns afterward, so the UI
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs .
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
OffSec Celebrates 20 Years of Practitioner-Built Training From the Creators of Kali Linux and OSCP
New York, USA, November 10th, 2026, CyberNewswire Meet the rest of OffSec as the company…
Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security
Columbus, Ohio, United States, November 10th, 2026, CyberNewswire Funding Will Scale Finite State’s Autonomous Platform…
Hackers Abuse Qubole’s Trusted AWS Access to Breach Multiple Cloud Accounts and Steal Sensitive Data
Hackers abused AWS credentials associated with Qubole to breach multiple customer cloud environments, harvest secrets,…
SAP November 2026 Patch Day Fixes Four Maximum-Severity Security Vulnerabilities
SAP released 35 new security notes and four GitHub security advisories on November 10, 2026,…
Russian-Linked Turla Hackers Abuse Microsoft Exchange Infrastructure to Target Sensitive Communications
Russian-linked espionage group Turla has deployed a previously undocumented .NET malware toolkit that turns compromised…
SEGA Confirms Data Breach Exposing 2.19 Million Customer Email Addresses Following Third-Party Cyberattack
SEGA confirmed on November 9, 2026, that attackers stole 2,196,044 customer email addresses after breaching…
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
