Topic
Scheduler
3 stories about Scheduler that passed the news check, newest first.
Security ·
CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
Apache Airflow 3.2.0 before 3.4.0 did not reject reserved serialization keys inside a Dag run's conf.
Open Source Security
Security ·
CVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors
CVE-2026-96285 affects Apache Airflow 3.3.0 before 3.4.0 and is rated moderate by the source.
Open Source Security
Security · High impact ·
CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.
Open Source Security