CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-67587

Apache Airflow (Task SDK, versions 3.3.0+ ) is vulnerable to a deserialization of untrusted data (CWE-502) in the Callback object reconstruction. When deserializing, the SDK re-runs the SyncCallback constructor, which imports the module named by the stored callback path. Because SyncCallback is a...