CVE-2026-68968 – Apache Airflow
“Unsafe deserialization and access-control gaps can expose Airflow’s most trusted components, credentials, and workflow boundaries.”
Apache Airflow is affected by 16 vulnerabilities covering unsafe deserialization, remote code execution, secret exposure, authorization weaknesses, and cross-team access. CVE-2026-33264 has a CVSS score of 9.8, Critical severity and can allow malicious DAG content to execute code in the API Server or Scheduler. CVE-2026-58076 and CVE-2026-67587 each have a CVSS score of 8.8, High severity; CVE-2026-67260 has a CVSS score of 7.3, High severity; and CVE-2026-68968 has a CVSS score of 7.5, High severity.
The remaining Medium vulnerabilities have CVSS scores from 4.3 to 6.5 and primarily expose secrets, Variables, configuration data, XCom content, audit logs, or team-scoped resources. The fixes span Airflow 3.2.2, 3.3.0, and 3.3.1, with 3.3.1 addressing multiple residual and follow-up weaknesses from earlier fixes.
Key Details
- Affected Product
- Apache Airflow
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-436