CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-67587

The apache-airflow-task-sdk is vulnerable to a Deserialization of Untrusted Data (CWE-502) vulnerability. The issue arises because the Task SDK rebuilds a Callback object from serialized data by re-running its constructor, which imports the module specified by the stored callback path. Since Sync...