www.reflectiz.com Critical Apache Airflow Flaw CVE-2026-68982 Enables Remote Code Execution
Article Content
- •CVE-2026-68982 allows unauthenticated remote code execution in Apache Airflow.
- •Affected versions are all prior to 3.4.0 using CeleryExecutor.
- •Upgrade to Airflow 3.4.0 is necessary to mitigate this vulnerability.
A critical flaw in Apache Airflow, tracked as CVE-2026-68982, allows unauthenticated remote code execution on worker nodes through the CeleryExecutor. This vulnerability affects all Airflow versions prior to 3.4.0, enabling attackers with write access to the Celery broker to run arbitrary Python functions without needing credentials, DAGs, or a scheduler. The flaw was discovered by security researcher Or Sahar from Reflectiz and is classified as CWE-306. The issue arises from the lack of authentication checks on ExecuteCallback messages, allowing attackers to forge messages to execute code. Affected users are advised to upgrade to Airflow 3.4.0, released on November 6, 2026, to mitigate the risk. The flaw has been publicly disclosed on November 9, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2026-68982 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Airflow are affected?
What should I do if I'm affected?
Is this vulnerability being actively exploited?
Continue Reading
SAP Patches Four Critical CVSS 10.0 Vulnerabilities on November 2026 Patch Day On November 10, 2026, SAP released security updates addressing four critical vulnerabilities rated CVSS 10.0. These include ICM2SHELL (CVE-2026-76964 and CVE-2026-89126), affecting the Internet Communication Manager and Web Dispatcher, and PROXYGATE (CVE-2026-89103) in SAP Gateway. A missing authentication flaw in the… 
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…