Apache Airflow, a platform widely used for orchestrating complex workflows, is currently under scrutiny due to a severe remote code execution (RCE) vulnerability. Identified as CVE-2026-68982, this flaw allows an attacker to execute code on worker nodes without authentication, posing a significant security threat.
The Nature of the Vulnerability
The vulnerability affects Airflow versions prior to 3.4.0 that utilize the CeleryExecutor. In these versions, the execute_workload task deserializes JSON input without verifying its origin or integrity, allowing malicious actors to execute arbitrary code. Unlike the web UI and REST API, which require authentication, the broker’s ExecuteCallback messages lack any form of validation.
This flaw, classified as CWE-306, indicates missing authentication for critical functions. The execute_workload function can import and execute any module available in the worker’s environment, enabling attackers to run any command.
Confirmed Exploitation and Impact
Researcher Or Sahar from Reflectiz confirmed the vulnerability on Airflow versions 3.2.1 and 3.3.0 in controlled environments using Docker Compose with a Redis broker and PostgreSQL backend. The vulnerability was initially intended for handling Deadline Alerts but remains experimental, thus broadening the potential attack surface.
Notably, the attack leaves minimal traces, making detection challenging. Demonstrations have shown that attackers could extract the worker’s hostname and environment variables, including sensitive keys. Reflectiz assessed the flaw with a CVSS score of 9.8, reflecting its critical nature.
Mitigation and Security Recommendations
Apache addressed this vulnerability in version 3.4.0, released on November 6, 2026, by implementing a single-use token system for task execution. Users are urged to upgrade both the Execution API server and CeleryExecutor workers to this latest version.
In the interim, enhancing security through Redis authentication or RabbitMQ credentials and restricting internet access to specific ports is advised. Furthermore, monitoring broker traffic and Celery worker logs for unusual execute_workload activities can help detect exploit attempts.
With Redis servers being frequent attack targets, the importance of securing these components has been underscored by previous incidents where vulnerabilities facilitated unauthorized cryptocurrency mining. As a proactive measure, security operations centers (SOCs) should integrate threat intelligence to swiftly address and mitigate potential security incidents.
