Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication

Apache Airflow has a critical remote code execution flaw that lets anyone with write access to the Celery message broker run code on worker nodes.

The attacker needs no credentials, DAG, or scheduler. The bug is tracked as CVE-2026-68982 and is classified as CWE-306, missing authentication for a critical function. It affects Airflow versions before 3.4.0 that run CeleryExecutor.

Airflow gives a worker three ways to receive instructions. The web UI and REST API require credentials. ExecuteTask messages on the broker carry a signed JWT, and the Execution API validates it through supervise_task() before the task runs. ExecuteCallback messages use the same execute_workload Celery task and the same broker, but nothing validates them.

The execute_workload task deserializes any JSON body into a typed object based only on its declared shape. There is no signature, no HMAC, and no broker-side ACL.

In version 3.2.1, execute_callback_workload() reads the path and kwargs values from the message, calls import_module and getattr, and then runs the callable with the attacker’s arguments.

In 3.3.0, this moved into a forked CallbackSubprocess. It builds an httpx. Client with the token but makes no network call and checks nothing, so the callback still runs first.

Because import_module can reach any module in the worker’s environment, the attacker gets full code execution. A message that names os.system with a shell command is enough.

Critical Apache Airflow RCE Flaw

Researcher Or Sahar of Reflectiz confirmed this on Airflow 3.2.1 and 3.3.0 in Docker Compose labs with a Redis broker and a PostgreSQL backend.

The callback path was built for Deadline Alerts, which run a function when a DAG run misses its deadline. The feature is still marked experimental, but that does not limit exposure.

The execute_workload task and its ExecuteCallback handler register on every CeleryExecutor worker as soon as the Celery provider loads. A deployment does not have to use Deadline Alerts to be vulnerable.

The attack also leaves no trace in Airflow. The proof of concept created zero DagRuns and zero TaskInstances, and /api/v2/dags still returned total_entries as 0. A recorded demo went further and dumped the worker’s hostname and every AIRFLOW__* environment variable, including the Fernet key.

Apache rates the flaw as Important and has not published a CVSS score. Reflectiz scored it 9.8 under CVSS v3.1 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Reflectiz also reported that 198 of 211 reachable Redis brokers in Airflow and Celery clusters answered without authentication. The flaw echoes CVE-2020-11981, an earlier case where broker access led to code execution on Airflow 1.10.10 and earlier.

Airflow 3.4.0, released November 6, 2026, fixes the flaw. The worker now redeems a single-use token with the Execution API before any callback runs. Apply the upgrade to the Execution API server and every CeleryExecutor worker. No earlier patched release exists.

Until the upgrade is done, turn on Redis AUTH or a RabbitMQ username and password, and block ports 6379 and 5672 from the internet. Since Airflow’s UI will not show this activity, audit broker traffic and Celery worker process logs for unexpected execute_workload messages.

Exposed Redis servers are a common target. Cyber Security News covered how hackers turned more than 3,500 Redis servers into Monero miners, and also reported on Apache Airflow flaws that expose sensitive data.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical Apache Airflow RCE Flaw Allows Attackers to Execute Code Without Authentication appeared first on Cyber Security News.