CVE-2026-58076

Apache Airflow CVE-2026-58076: The vulnerability stems from the serialization layer reconstructing exception nodes by calling import_string() on a class name from the serialized blob, with no restriction on what can be imported. An operator’s executor_config can trigger a value that imports and i...