Apache Airflow CVE-2026-68982: Forged Celery Callbacks Can Run Code on Workers Without an Airflow Login, and Why to Upgrade to 3.4.0

Apache Airflow is the open-source tool many companies use to schedule data pipelines, reports and ETL jobs. It has a flaw that lets anyone who can write messages to its Celery queue run their own code on the machines that do the work, with no Airflow login. Apache fixed it in Airflow 3.4.0, released Friday, November 6, 2026, and published the advisory for CVE-2026-68982 on Monday, November 9, 2026. If your team runs Airflow with CeleryExecutor, plan the upgrade this week.

What is CVE-2026-68982?

Airflow hands its work to processes called workers. With CeleryExecutor, Airflow puts jobs on a message broker, such as Redis or RabbitMQ, and the Celery workers pick them up and run them.

Apache's advisory says CeleryExecutor ran callback workloads without validating the workload's authentication token. These are the ExecuteCallback jobs used for deadline-alert callbacks. So if someone puts a forged callback on the broker, every CeleryExecutor worker will run it as if Airflow had sent it.

What is confirmed and what is not

Confirmed by Apache's advisory and the CVE record:

• Affected: Apache Airflow versions before 3.4.0, in deployments that use CeleryExecutor. The CVE record names the apache-airflow-core package.
• What an attacker needs: write access to the Celery broker. Airflow credentials are not required.
• What they get: the ability to run arbitrary code on every CeleryExecutor worker.
• Severity: Apache rates it Important. The CVE record has no numeric CVSS score. Some news coverage calls it critical, but that is not Apache's rating.
• Fix: upgrade to apache-airflow 3.4.0 or later.
• Credit: Or Sahar of Reflectiz found it. Sean Ghaeli developed the fix.

Not known:

• Apache has not said whether anyone has used this in an attack, and we found no report of exploitation.
• Headlines calling it "unauthenticated remote code execution" are only half right. No Airflow login is needed, but the attacker first has to be able to write to your broker. How hard that is depends on how your broker is set up.

Who is affected by the Airflow Celery vulnerability?

You are in scope if both of these are true:

1. Your Airflow version is older than 3.4.0.
2. CeleryExecutor is one of your configured executors.

The advisory only names CeleryExecutor deployments. If you only run LocalExecutor or KubernetesExecutor, it does not list you, but 3.4.0 is still the current release and worth planning for. If a hosted Airflow service runs Airflow for you, the provider controls the version, so ask them when 3.4.0 will reach your environment.

Why broker access is the real question

Teams often treat the Celery broker as internal plumbing. Typical shortcuts are a Redis instance with no password on the internal network, a broker shared with other applications, or broker credentials copied into many configuration files. Before this fix, any one of those turned a foothold anywhere near the broker into code running on your Airflow workers.

That matters because workers do the real work. They usually run with access to the databases, cloud storage, data warehouses and APIs that your pipelines touch. Code running on a worker can often reach the same systems and secrets.

How the fix in Airflow 3.4.0 works

The 3.4.0 release notes say a worker now redeems a callback's single-use token with the API server before the callback runs (pull request #71192). The pull request explains the design. Each callback gets a token tied to that callback only. The worker trades it in once through Airflow's Execution API, which marks the callback as running. A second use of the same token is refused. A replayed or forged message on the broker therefore no longer runs on its own say-so.

How to check your Airflow version and executor

Run these on a machine with your Airflow installation:

airflow version
airflow config get-value core executor
pip show apache-airflow-core

If the version is below 3.4.0 and the executor setting includes CeleryExecutor, you are affected. Check every environment, including staging and any separate worker images, because workers built from an older container image will keep running old code after the scheduler is upgraded.

What to do this week

Apache lists only one fix, the upgrade. Steps 4 to 6 are our own hardening advice. They are worth doing anyway, and they lower the risk while you schedule the upgrade.

Before you upgrade to Airflow 3.4.0

3.4.0 is a feature release, not a small patch, so read the release notes before you upgrade. Points that catch teams out:

• Python: Airflow 3.4.0 dropped Python 3.10. You need Python 3.11 or newer.
• Postgres driver: psycopg3 is now the default. psycopg2 and asyncpg need explicit extras.
• Rollback: downgrading below 3.4.0 can be slow, and a failed MySQL downgrade can leave the schema partly downgraded. Back up the metadata database first.
• Behaviour changes: asset-triggered DAGs now create one run per event by default, and heartbeat retry settings have changed.

Test in staging, back up, then upgrade production. If your Airflow runs on servers you manage yourself, our self-hosting and infrastructure work covers this kind of planned upgrade.

Why this matters for a company network

Airflow often sits in the middle of a company's data. It pulls from sales systems, pushes to warehouses and feeds reports that leaders rely on. A flaw like this does not need a stolen admin password. It needs one weak link next to the broker. Ask who owns the Airflow upgrade, who owns the broker, and whether those are the same person. We wrote about that gap in Who Is Patching the Software That Runs Your Business?.

Apache Airflow CVE-2026-68982 questions people are asking

Is Apache Airflow CVE-2026-68982 critical?

Apache rates it Important, and the CVE record has no numeric CVSS score. Some news coverage calls it critical, but that is not Apache's rating.

Does an attacker need an Airflow login?

No. They need write access to the Celery broker, and no Airflow credentials.

Which Airflow versions are affected?

All versions before 3.4.0, in deployments that use CeleryExecutor.

What version fixes the Airflow Celery vulnerability?

Apache Airflow 3.4.0, released November 6, 2026, or any later version.

Is CVE-2026-68982 being exploited?

Apache has not said it has been exploited, and we found no report of attacks.

Do I need to upgrade if I use KubernetesExecutor or LocalExecutor?

The advisory only names CeleryExecutor deployments. Upgrading to the current release is still good practice.

Who found CVE-2026-68982?

Or Sahar of Reflectiz reported it. Sean Ghaeli developed the fix.

The bigger lesson

Internal plumbing is still part of the attack surface. Message brokers, queues and caches often run with no password because "only our own systems talk to them." This Airflow fix closes one path, but the habit behind it applies to every service on your network: require authentication, encrypt the connection, limit who can reach it and know who keeps it patched.

Want your data stack locked down and kept up to date? See security hardening or get a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Apache Airflow advisory for CVE-2026-68982 on oss-security; Apache Airflow 3.4.0 release notes; apache/airflow pull request #71192; CVE record CVE-2026-68982.