Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication
Critical RCE flaw in Apache Airflow allows unauthenticated code execution on worker nodes.
A critical remote code execution vulnerability (CVE-2026-68982) has been discovered in Apache Airflow versions prior to 3.4.0 when using CeleryExecutor. Attackers with write access to the Celery message broker can execute arbitrary code on worker nodes without authentication. The vulnerability stems from insufficient validation of 'ExecuteCallback' messages, allowing attackers to import and run any module within the worker's environment. Apache rates the flaw as 'Important', while Reflectiz scored it 9.8/10 and noted that many Redis brokers are exposed without authentication.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apache Airflow?
Get an email when a new story names Apache Airflow, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical flaw (CVE-2026-68982) in Apache Airflow allows attackers with write access to an exposed Celery message broker—such as an unauthenticated Redis instance—to execute arbitrary code on worker nodes without any credentials. The root vulnerability is insufficient validation of 'ExecuteCallback' messages, enabling arbitrary module imports and execution within the worker environment. This is compounded by the widespread practice of leaving Redis brokers internet-exposed without authentication, dramatically lowering the bar for exploitation. With a CVSS-equivalent score of 9.8, this represents a near-worst-case scenario: a remotely reachable, unauthenticated code execution path in widely deployed workflow automation infrastructure.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-68982