CVE-2026-45360 Details
Description
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
A vulnerability exists in Apache Airflow's scheduler-side deadline-reference decoder, specifically in versions prior to 3.2.2. The issue arises because the decoder imports and dispatches arbitrary class paths from DAG-author-controlled serialized state without any allowlist or plugin-registry validation. In environments where DAG-author code is less trusted than the scheduler process, a DAG author could embed a custom 'DeadlineReference' that references an attacker-controlled module path. This would lead the scheduler to import the specified class and instantiate it with an active SQLAlchemy session. The vulnerability is particularly concerning in single-host deployments where the DAG bundle can be imported by the scheduler.
Users are advised to upgrade to Apache Airflow version 3.2.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/31/12 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/66737 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83 | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.2.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CVE |
| Jun 1, 2026 | New CVE Received | [email protected] |