Skip to content
OpenAdvisories
High · 8.2 CVE-2026-111395 EUVD-2026-119892GHSA-r5x9-822m-2crg

Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Published Nov 9, 2026 · Updated Nov 12, 2026 · Assigned by apache

Description

Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. Users are advised to upgrade to apache-airflow 3.4.0 or later.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow 3.2.0 – < 3.4.0 3.4.0

Advisories 1

References