Security · High impactFan score 21 · Tier C
CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
The Brief
- Apache Airflow before 3.4.0 ran CeleryExecutor callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload token.
- The oss-sec advisory by Rahul Vats, posted Nov 8, rates the issue as important and tracks it as CVE-2026-68982.
- Forged callback workloads could run on Celery workers.
Why it matters
Teams running Apache Airflow with CeleryExecutor on versions before 3.4.0 may have workers that execute forged callback workloads, so they should check their version and upgrade.
Who’s affected
- Apache Airflow teams using CeleryExecutor
- Anyone running Apache Airflow before 3.4.0
What to do
- Upgrade Apache Airflow to 3.4.0 or later
- Apache Airflow 3.4.0
- CVE-2026-68982
- #apache-airflow
- #celery
- #security
- #vulnerability
- #workflow-orchestration
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's…
Timeline
Vulnerability disclosed on oss-sec by Rahul Vats
Open Source Security
CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation