Description
Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. Users are advised to upgrade to apache-airflow 3.4.0 or later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 3.2.0 – < 3.4.0 | 3.4.0 |
Advisories 1
- WID-SEC-2026-4401 Apache Airflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026