CVE-2026-68982

Apache Airflow's CeleryExecutor is vulnerable because it processes ExecuteCallback workloads (used for deadline-alert callbacks) without validating the authentication token. An attacker capable of writing to the Celery broker can enqueue a forged callback to achieve arbitrary code execution on ev...