CVE-2026-67587 Apache CVE debrief

Who should care

Airflow users and administrators should assess exposure and prioritize upgrading to a fixed version. Affected operators should review compensating controls for exposed systems while remediation is scheduled and verified. Security teams need to track exceptions, retest remediated assets, and close the item only after evidence is documented. Those responsible for platform and vulnerability management must ensure proper mitigations are in place to prevent or

Why it matters

This vulnerability allows a Dag author to import an arbitrary module in the scheduler process, potentially leading to code execution. Airflow users and administrators should prioritize upgrading to a fixed version to mitigate this risk.

• Potential code execution in the scheduler process
• Arbitrary module import vulnerability
• Elevation of privileges for Dag authors

Technical summary

The Apache Airflow Task SDK rebuilds a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. This allows a Dag author to cause an arbitrary module to be imported inside the scheduler process when the scheduler's awaiting_input timeout sweep deserializes that value. The vulnerability requires no non-default configuration; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization.

Defensive priority

High

Recommended defensive actions

• Upgrade to apache-airflow 3.3.1 or later
• Review and restrict deserialization of Callback objects
• Monitor for suspicious activity in the scheduler process
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, including its description, CVSS score, and affected versions. The Apache Airflow project has released a patch for this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.