SecurityFan score 21 · Tier C
CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
The Brief
- Apache Airflow 3.2.0 before 3.4.0 did not reject reserved serialization keys inside a Dag run's conf.
- A user allowed to trigger a Dag that uses a deadline alert can crash the scheduler or have crafted objects rebuilt in the Triggerer via deadline callbacks.
- The advisory is tracked as CVE-2026-111395 and rated moderate.
Why it matters
Teams running Airflow 3.2 or 3.3 with deadline alerts can have their scheduler crashed by a user who can trigger Dags, so upgrading to 3.4.0 or later closes the exposure.
Who’s affected
- Apache Airflow 3.2.x and 3.3.x users who run Dags with deadline alerts
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
- Apache Airflow 3.2.0
- Apache Airflow 3.4.0
- CVE-2026-111395
- #apache-airflow
- #security
- #cve-2026-111395
- #scheduler
- #deadline-alerts
- #serialization
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow 3.2.0 before 3.4.0 Description: Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an…
Timeline
Vulnerability advisory posted to the oss-security list by Rahul Vats
Open Source Security
CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks