CVE-2026-68982

{
  "etk_id": "ETK-2026-3944",
  "cve_id": "CVE-2026-68982",
  "display_id": "CVE-2026-68982",
  "ghsa_id": "GHSA-3m38-qxxm-8g9g",
  "euvd_id": "EUVD-2026-119905",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated callback injection in Airflow CeleryExecutor",
  "summary": "Apache Airflow deployments using CeleryExecutor can accept forged callback workloads because callback authentication is not verified before execution. An attacker who can write to the Celery broker can cause code to run on CeleryExecutor workers without Airflow credentials.",
  "mitigation": "Upgrade apache-airflow-core to version 3.4.0 or later. Restrict write access to the Celery broker until all affected workers are upgraded.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Airflow",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.4.0"
      ],
      "ecosystem": "pypi",
      "fixed_versions": [
        "3.4.0"
      ],
      "package_name": "apache-airflow-core",
      "purl": "pkg:pypi/apache-airflow-core"
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.997624816666665,
  "t0_at": "2026-11-09T09:55:00.238000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T09:55:00.238000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T09:55:00.238000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68982"
    }
  }
}