# CVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/590) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-96285-apache-airflow-scheduler-next-kwargs-deserialized-before-the-dict-b6c4f3ebf9ddb045
Kind: security · Impact: medium

## In brief

- CVE-2026-96285 affects Apache Airflow 3.3.0 before 3.4.0 and is rated moderate by the source.
- Airflow 3.3.1 added a check that the scheduler's decoded next_kwargs is a dictionary, but the check runs only after deserialization.
- Resume data can therefore still invoke constructors, which the earlier fix for CVE-2026-67260 was meant to prevent.

## Why it matters

Teams running Airflow 3.3.x may believe the CVE-2026-67260 fix covers them, but scheduler resume data can still trigger constructor calls before the dictionary check runs.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow 3.3.0
- Apache Airflow 3.3.1
- Apache Airflow 3.4.0

## CVEs

- CVE-2026-96285
- CVE-2026-67260

## Timeline

- 2026-11-08: Vulnerability disclosed on the oss-security mailing list

## Coverage

- [CVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors](https://seclists.org/oss-sec/2026/q4/590) — Open Source Security, 2026-11-09

Tags: apache airflow, scheduler, deserialization, vulnerability, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev