CVE-2026-67587

CVE-2026-67587 affects Apache Airflow (Task SDK). The vulnerability arises when a Dag author can cause the scheduler process to import an arbitrary module during the awaiting_input deserialization of a Callback object, via a serialized next_kwargs value. The root cause is that SyncCallback is rec...