Vulnerability · high
Apache Airflow CeleryExecutor forged callback workloads (CVE-2026-68982)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Airflow deployments using CeleryExecutor below version 3.4.0
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later
The Brief
- Apache Airflow before 3.4.0 ran CeleryExecutor callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload token.
- The oss-sec advisory by Rahul Vats, posted Nov 8, rates the issue as important and tracks it as CVE-2026-68982.
- Forged callback workloads could run on Celery workers.
Why it matters
Teams running Apache Airflow with CeleryExecutor on versions before 3.4.0 may have workers that execute forged callback workloads, so they should check their version and upgrade.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Apache Airflow is a workflow orchestrator that data and ops teams build and run. |
| No | Core infrastructure | Airflow is a single popular framework, not software nearly every team runs like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Apache Airflow is a widely used mainstream data orchestration platform. |
| No | Exploited in the wild | oss-sec post (Open Source Security, 2026-11-09) describes the flaw only; no source reports observed attacks. |
| No | Public exploit | oss-sec post gives an advisory and no source says exploit code or a PoC is published. |
| No | Remote, no login | oss-sec post says workloads run without token validation but does not state unauthenticated network access. |
| No | Full takeover | oss-sec post says forged workloads run on Celery workers but does not explicitly state code execution or admin rights. |
| No | Secrets exposed | oss-sec post reports no stolen or exposed credentials, configs or data. |
| No | Supply chain | oss-sec post describes a validation flaw in CeleryExecutor, not a compromised package, update or pipeline. |
| No | No fix yet | oss-sec post lists affected versions as before 3.4.0, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on oss-sec by Rahul Vats
Open Source Security
CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Source
CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided