CVE-2026-31072 Details
Description
The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers
A remote code execution vulnerability has been identified in the JSONSerializer and CBORSerializer components of APScheduler, affecting all versions in the 3.10.x series and the 4.0.0a5 release. This vulnerability arises from insecure deserialization, where the unmarshal_object function allows arbitrary class instantiation and state injection by dynamically importing modules and invoking __setstate__ on any class available in the Python environment. An attacker can exploit this by sending a specially crafted JSON or CBOR payload to an application that utilizes these serializers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-31072 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2479907 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31072.json | redhat-SADP | |
| https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6 | CISA-ADP | ExploitTechnical Description |
| https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6 | [email protected] | ExploitTechnical Description |
| https://github.com/agronholm/apscheduler | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | redhat-SADP |
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| APScheduler | 4.0.0a3 4.0.0a4 4.0.0a5 4.0.0a6 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 20, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |