CVE-2026-45360

Apache Airflow's scheduler-side deadline-reference decoder "SerializedCustomReference.deserializereference" imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler —...