CVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

The Brief

CVE-2026-96285 affects Apache Airflow 3.3.0 before 3.4.0 and is rated moderate by the source.
Airflow 3.3.1 added a check that the scheduler's decoded next_kwargs is a dictionary, but the check runs only after deserialization.
Resume data can therefore still invoke constructors, which the earlier fix for CVE-2026-67260 was meant to prevent.

Why it matters

Teams running Airflow 3.3.x may believe the CVE-2026-67260 fix covers them, but scheduler resume data can still trigger constructor calls before the dictionary check runs.

Who’s affected

Anyone running Apache Airflow 3.3.0 before 3.4.0

What to do

Upgrade Apache Airflow to 3.4.0 or later

Apache Airflow 3.3.0
Apache Airflow 3.3.1
Apache Airflow 3.4.0
CVE-2026-96285
CVE-2026-67260
#apache airflow
#scheduler
#deserialization
#vulnerability
#cve

Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow 3.3.0 before 3.4.0 Description: Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only…

Read the full story at seclists.org ↗

Timeline

Nov 8
Vulnerability disclosed on the oss-security mailing list
Nov 9 · 7:14 AM
Open Source Security
CVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors