CVE-2026-96285

Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded nextkwargs value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list...