EUVD-2026-119902

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes wi...

CVE-2026-82337

Apache Airflow is vulnerable to a security issue where deadline alert fields are rebuilt through generic deserialization . This process imports and instantiates classes named in the serialized Dag within the scheduler and API server processes. A Dag author can exploit this to construct classes fr...