{"id":6149,"date":"2026-09-04T18:48:21","date_gmt":"2026-09-04T10:48:21","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-67587"},"modified":"2026-09-04T18:48:21","modified_gmt":"2026-09-04T10:48:21","slug":"cve-2026-67587","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-67587","title":{"rendered":"CVE-2026-67587 [HIGH] &#8211; Apache Airflow&#8217;s Task SDK rebuilt a `Callback` object from serialized data by re-running i"},"content":{"rendered":"<p>Apache Airflow&#8217;s Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author \u2014 who controls a task instance&#8217;s `next_kwargs` through the task execution API \u2014 can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler&#8217;s `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization \u2014 applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apache Airflow&#8217;s Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6149","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}