CVE-2026-68982 Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation

Apache Airflow's CeleryExecutor ran callback workloads ExecuteCallback, used for deadline-alert callbacks without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker,...