CVE-2026-82337

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected. This is an incomplete fix of CVE-2026-45360, which only hardened the `reference` field; deployments that applied that fix remain affected through the `callback` and `interval` fields. Users of apache-airflow are recommended to upgrade to 3.4.0 or later.

• CWE-502

• https://github.com/apache/airflow/pull/72651
• https://github.com/apache/airflow/pull/74830
• https://lists.apache.org/thread.html/9v8f3hlm6pxbwl2jt1c2bw84s80gg6kp
• https://www.cve.org/CVERecord?id=CVE-2026-45360

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82330A flaw was found in the file-pvr plugin in GIMP. When proces…6.1
• CVE-2026-82331Improper link resolution before file access ('link following…9.8
• CVE-2026-82332An improper authentication vulnerability in WatchGuard Firew…5.7
• CVE-2026-82333multer is a middleware for handling multipart/form-data in N…7.5
• CVE-2026-82334IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable …9.1
• CVE-2026-82335IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable …9.8
• CVE-2026-8234A security vulnerability has been detected in EFM ipTIME A80…8.8
• CVE-2026-82340IBM Guardium Data Protection 12.2 is vulnerable to unauthent…9.8
• CVE-2026-82343A flaw was found in the file-psd plugin in GIMP. When proces…6.1
• CVE-2026-82344IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a h…9.8
• CVE-2026-82346A potential security vulnerability has been identified in th…7
• CVE-2026-82348Authorization Bypass Through User-Controlled Key in Apache R…7.7