# CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/593) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-111395-apache-airflow-reserved-serialization-keys-in-dag-run-conf-crash-adb8b50b7bbc129f
Kind: security · Impact: medium

## In brief

- Apache Airflow 3.2.0 before 3.4.0 did not reject reserved serialization keys inside a Dag run's conf.
- A user allowed to trigger a Dag that uses a deadline alert can crash the scheduler or have crafted objects rebuilt in the Triggerer via deadline callbacks.
- The advisory is tracked as CVE-2026-111395 and rated moderate.

## Why it matters

Teams running Airflow 3.2 or 3.3 with deadline alerts can have their scheduler crashed by a user who can trigger Dags, so upgrading to 3.4.0 or later closes the exposure.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later.

## Versions

- Apache Airflow 3.2.0
- Apache Airflow 3.4.0

## CVEs

- CVE-2026-111395

## Timeline

- 2026-11-08: Vulnerability advisory posted to the oss-security list by Rahul Vats

## Coverage

- [CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks](https://seclists.org/oss-sec/2026/q4/593) — Open Source Security, 2026-11-09

Tags: apache-airflow, security, cve-2026-111395, scheduler, deadline-alerts, serialization

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev