CVE-2026-68982

Apache Airflow's CeleryExecutor ran callback workloads ExecuteCallback, used for deadline-alert callbacks without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker,...