Deserialization in Apache Software Foundation Airflow
CVE-2026-58076
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imp…
Vulnerability class: Insecure Deserialization
Affected products
- Apache Software Foundation Airflow — versions 3.0.0
Weakness classification (CWE)
References
- security@apache.org (patch)
- security@apache.org (related)
- security@apache.org (vendor-advisory)