Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication

Cybersecuritynews •Abinaya • November 10, 2026

Apache Airflow has a critical remote code execution flaw that lets anyone with write access to the Celery message broker run code on worker nodes. The attacker needs no credentials, DAG, or scheduler. The bug is tracked as CVE-2026-68982 and is classified as CWE-306, missing authentication for a critical function. It affects Airflow versions before […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Apache Airflow Flaw CVE-2026-68982 Enables Remote Code Execution A critical flaw in Apache Airflow, tracked as CVE-2026-68982, allows unauthenticated remote code execution on worker nodes through the CeleryExecutor. This vulnerability affects all Airflow versions prior to 3.4.0, enabling attackers with write access to the Celery broker to run arbitrary Python functions without needing credentials, DAGs, or a scheduler. The flaw was discovered by security researcher Or Sahar from Reflectiz and is classified as CWE-306. The issue arises from the lack of authentication checks on ExecuteCallback messages, allowing attackers to forge messages to execute code. Affected users are advised to upgrade to Airflow 3.4.0, released on November 6, 2026, to mitigate the risk. The flaw has been publicly disclosed on November 9, 2026. 2 sources 72

Extracted Entities

Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)