As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow's Apache Kafka provider versions 1.15.0 through 1.x resolve untrusted dotted-path strings from Kafka connection configurations into Python callables without validation, allowing remote code execution on the Scheduler. The vulnerability affects deployments where untrusted users can modify Kafka connections.
Why it matters: Airflow operators and administrators running Apache Kafka provider 1.15.0 to 1.x should upgrade to 2.0.0 or later to prevent remote code execution via malicious Kafka connection callbacks on the Scheduler.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow's Kafka provider, in versions 1.15.0 before 2.0.0, dynamically loads Python callables from connection configuration without validation, allowing arbitrary code execution on the Scheduler. The vulnerability stems from unsafe deserialization of dotted-path strings in Kafka connection settings passed to the confluent-kafka client.
Why it matters: Organizations running Apache Airflow with the Kafka provider on versions before 2.0.0 face remote code execution risk on Scheduler instances if an attacker can modify connection configuration; immediate patching is critical for affected deployments.
- Source published
- First seen by Cybersecurity Tracker