# CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/585) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-68982-apache-airflow-celeryexecutor-forged-callback-workloads-run-on-ce-3ac2423429d1d628
Kind: security · Impact: high

## In brief

- Apache Airflow before 3.4.0 ran CeleryExecutor callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload token.
- The oss-sec advisory by Rahul Vats, posted Nov 8, rates the issue as important and tracks it as CVE-2026-68982.
- Forged callback workloads could run on Celery workers.

## Why it matters

Teams running Apache Airflow with CeleryExecutor on versions before 3.4.0 may have workers that execute forged callback workloads, so they should check their version and upgrade.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow 3.4.0

## CVEs

- CVE-2026-68982

## Timeline

- 2026-11-08: Vulnerability disclosed on oss-sec by Rahul Vats

## Coverage

- [CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation](https://seclists.org/oss-sec/2026/q4/585) — Open Source Security, 2026-11-09

Tags: apache-airflow, celery, security, vulnerability, workflow-orchestration

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev