CVE-2026-86792 Apache Software Foundation CVE debrief

Who should care

Airflow administrators and users with privileges to edit connections should assess exposure and prioritize upgrading to a fixed version. Affected deployments have enabled the Kafka event producer — `dag_run_events_enabled` or `task_instance_events_enabled`. These users should review and limit their privileges, monitor for suspicious activity, and verify affected versions and exposure.

Why it matters

CVE-2026-86792 is a high-severity vulnerability in the Apache Airflow Apache Kafka provider that allows for arbitrary code execution in the control plane. Airflow administrators and users with privileges to edit connections should assess exposure and prioritize upgrading to a fixed version.

• Arbitrary code execution in the control plane
• Potential for lateral movement and privilege escalation
• Need for verification of affected versions and exposure
• Priority for upgrading to a fixed version

Technical summary

The Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. This allows for arbitrary code execution in the control plane when the Kafka event producer is enabled. Deployments using Google Managed Kafka are not affected. Users are recommended to upgrade to apache-airflow-providers-apache-kafka 2.0.0 or later, which adds an allowlist configuration option for connection-string callbacks.

Defensive priority

High

Recommended defensive actions

• Upgrade to apache-airflow-providers-apache-kafka 2.0.0 or later
• Review and limit user privileges for editing Airflow connections
• Monitor for suspicious activity in the scheduler process
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, which is related to the Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0. The vulnerability allows for arbitrary code execution in the control plane when the Kafka event producer is enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.