EN PT-BR
← Voltar ao feed
high

Apache Airflow 3.4.0 and Storm patch 20 flaws, incl. CVE-2026-68982 code execution on Celery workers

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 21:30 · coletado há 1 hora

On November 9, 2026 the Apache Software Foundation disclosed 20 security flaws, 18 in Apache Airflow and 2 in Apache Storm (securityonline.info). The most serious is CVE-2026-68982 in the CeleryExecutor, which ran deadline-alert callback workloads without validating their authentication token (strix.ai). Anyone able to write to the Celery broker could enqueue a forged callback and execute code on every CeleryExecutor worker, without Airflow credentials (strix.ai). Apache has published no CVSS score for the batch, and no in-the-wild exploitation or public proof-of-concept has been confirmed (securityonline.info). Criticity is high rather than critical: exploiting the most serious bug requires write access to the Celery broker, several other bugs need a non-default setup or Dag-author rights, and no exploitation is confirmed, yet Airflow pipelines hold database passwords, cloud keys and API tokens.

Entenda a falha

A vulnerabilidade

CVE-2026-68982, the most serious of 20 flaws Apache disclosed (18 in Airflow, 2 in Storm), is in Airflow's CeleryExecutor. It ran deadline-alert callback workloads without validating their authentication token (CWE-306). An attacker who can write to the Celery broker, with no Airflow credentials, can enqueue a forged callback and run code on every CeleryExecutor worker. All versions before 3.4.0 are affected; 3.4.0 fixes it. The other Airflow bugs include CVE-2026-86829 and CVE-2026-82337 (Dag-author deserialization and class construction in the scheduler and API server), CVE-2026-76185 (cross-team secret reads in multi-team setups), CVE-2026-107474 (Apprise credentials returned in cleartext by the connections API) and CVE-2026-101031 (only with the bundled example Dags loaded). In Storm, CVE-2026-82436 is unsafe deserialization that needs the non-default Redis state provider, and CVE-2026-82440 allows any scheduler strategy class. Apache has published no CVSS scores.

Como funciona

In Airflow, a deadline alert fires and its callback is sent as a workload through the Celery broker to a worker. The worker is supposed to check the workload's authentication token before running it. In the vulnerable versions it did not, so a message placed on the broker by anyone with write access was treated as legitimate and executed. In Storm, stateful bolts checkpoint their state to a store, and on recovery the DefaultStateSerializer deserialized whatever bytes the store returned, with Kryo class registration disabled.

Por que é vulnerável

For CVE-2026-68982 the cause is a missing authentication check on the callback workload, so the worker trusted anything arriving on the broker. The 3.4.0 fix makes the worker redeem the callback's single-use token with the API server before running it, which moves the callback from queued to running and swaps in a short-lived execution-scoped token. In Storm, the serializer trusted stored bytes with class registration off, and the Nimbus scheduler allowlist was treated as allow-any-class when unset, with no entry in the shipped defaults. Storm 3.1.0 makes the serializer require registered classes, which may require migrating existing checkpoints.

Onde está

For CVE-2026-68982, the CVE record cites Airflow PR #71192 as the patch and also references PR #70927; the flaw is in the CeleryExecutor's handling of deadline-alert callbacks. A follow-up PR, #76571, reports that a slow Execution API response can make the token exchange fail. In Storm, the articles name the DefaultStateSerializer (CVE-2026-82436) and the Nimbus scheduler strategy allowlist (CVE-2026-82440).

Como foi descoberta

The articles do not say who found these flaws or how. The Apache Software Foundation disclosed the 20 flaws on November 9, 2026, alongside the Airflow 3.4.0 release (listed with a date of 2026-11-06) and the Storm 3.1.0 release. No exploitation in the wild has been confirmed. The sources disagree on Storm's fixed version: securityonline.info says 3.2.0, while the ASF news page and CNA-based records say 3.1.0.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 22:16.

Detalhes técnicos

According to the article, CVE-2026-86829 lets a Dag author push XCom data that the scheduler fully deserializes, and CVE-2026-82337 lets a Dag author construct allowed classes inside the scheduler and API server (securityonline.info). CVE-2026-76185 lets a Dag author read another team's secrets in multi-team setups, and CVE-2026-107474 returned Apprise notification credentials in cleartext through the connections API (securityonline.info). Other secret-masking gaps missed camelCase key names, nested values and some CLI arguments, and CVE-2026-101031 affects only deployments that load the bundled example Dags (securityonline.info). The CVE record classifies CVE-2026-68982 as CWE-306 and lists every version before 3.4.0 as affected (cve.threatint.com).

In Apache Storm, CVE-2026-82436 (CWE-502) affects the DefaultStateSerializer used for stateful bolt checkpoints. It disabled Kryo class registration and deserialized whatever bytes the state store returned, and it needs the Redis-backed state provider, which is not the default (storm.apache.org/news.html). CVE-2026-82440 lets a topology name any scheduler strategy class, because the Nimbus allowlist was treated as allow-any-class when unset, and the shipped defaults contain no entry for it (strix.ai).

Detalhes da correção

The CVE record for CVE-2026-68982 cites PR #71192 (github.com/apache/airflow/pull/71192) as its patch and also references PR #70927 (cve.threatint.com). The research did not open either PR page, so the author, the open date and the merge date are not confirmed. The Airflow 3.4.0 release notes describe the change: a worker now redeems the callback's single-use token with the API server before running it, which moves the callback from queued to running and swaps in a short-lived execution-scoped token (airflow.apache.org). These notes list 3.4.0 with a date of 2026-11-06 (airflow.apache.org/docs/apache-airflow/stable/release_notes.html). A follow-up PR, #76571 (github.com/apache/airflow/pull/76571), reports that a slow Execution API response can make the single-use token exchange fail, so a deadline callback is marked failed without running.

For Storm, the ASF news page says the 3.1.0 release makes the state serializer require registered classes, a behaviour change that may require migrating existing checkpoints (storm.apache.org/news.html). The CNA-based record places the fix for CVE-2026-82440 in 3.1.0 (strix.ai).

Remediação

  • Upgrade apache-airflow to 3.4.0 (securityonline.info; airflow.apache.org).
  • Restrict write access to the Celery broker to Airflow components only (securityonline.info).
  • Disable load_examples in production (securityonline.info).
  • Upgrade Storm to the 3.1.0 line per the ASF and the CNA record, and set an explicit scheduler strategy allowlist (storm.apache.org/news.html; strix.ai).
  • Until Storm is upgraded, restrict network and credential access to the state store to the cluster itself (storm.apache.org/news.html).
  • Rotate any secrets that may have reached audit logs before the upgrade (securityonline.info).

Relatos divergentes

  • Storm fixed version: the article says Storm 3.2.0 is the fixed release. The ASF news page and the CNA-based records place the fix for CVE-2026-82436 and CVE-2026-82440 in 3.1.0 (storm.apache.org/news.html; strix.ai). The vendor's version is used here, and the 3.2.0 figure is unverified.
  • Severity: the article rates CVE-2026-82436 as high. Apache has published no CVSS score for any of the flaws, and the CNA-based records show severity as unscored (strix.ai). VulDB labels CVE-2026-68982 as critical while listing no vendor score (vuldb.com). The vendor's status (unscored) is used here.

Linha do tempo

  1. securityonline.info ↗ · pub. 09/11/2026 21:30 · coletado 09/11 22:00 primeiro registro

    Apache Airflow 3.4.0 and Storm patch 20 flaws, incl. CVE-2026-68982 code execution on Celery workers

    ler a análise desta fonte

    On November 9, 2026 the Apache Software Foundation disclosed 20 security flaws, 18 in Apache Airflow and 2 in Apache Storm (securityonline.info). The most serious is CVE-2026-68982 in the CeleryExecutor, which ran deadline-alert callback workloads without validating their authentication token (strix.ai). Anyone able to write to the Celery broker could enqueue a forged callback and execute code on every CeleryExecutor worker, without Airflow credentials (strix.ai). Apache has published no CVSS score for the batch, and no in-the-wild exploitation or public proof-of-concept has been confirmed (securityonline.info). Criticity is high rather than critical: exploiting the most serious bug requires write access to the Celery broker, several other bugs need a non-default setup or Dag-author rights, and no exploitation is confirmed, yet Airflow pipelines hold database passwords, cloud keys and API tokens.

    Technical Details

    According to the article, CVE-2026-86829 lets a Dag author push XCom data that the scheduler fully deserializes, and CVE-2026-82337 lets a Dag author construct allowed classes inside the scheduler and API server (securityonline.info). CVE-2026-76185 lets a Dag author read another team's secrets in multi-team setups, and CVE-2026-107474 returned Apprise notification credentials in cleartext through the connections API (securityonline.info). Other secret-masking gaps missed camelCase key names, nested values and some CLI arguments, and CVE-2026-101031 affects only deployments that load the bundled example Dags (securityonline.info). The CVE record classifies CVE-2026-68982 as CWE-306 and lists every version before 3.4.0 as affected (cve.threatint.com).

    In Apache Storm, CVE-2026-82436 (CWE-502) affects the DefaultStateSerializer used for stateful bolt checkpoints. It disabled Kryo class registration and deserialized whatever bytes the state store returned, and it needs the Redis-backed state provider, which is not the default (storm.apache.org/news.html). CVE-2026-82440 lets a topology name any scheduler strategy class, because the Nimbus allowlist was treated as allow-any-class when unset, and the shipped defaults contain no entry for it (strix.ai).

    Fix Details

    The CVE record for CVE-2026-68982 cites PR #71192 (github.com/apache/airflow/pull/71192) as its patch and also references PR #70927 (cve.threatint.com). The research did not open either PR page, so the author, the open date and the merge date are not confirmed. The Airflow 3.4.0 release notes describe the change: a worker now redeems the callback's single-use token with the API server before running it, which moves the callback from queued to running and swaps in a short-lived execution-scoped token (airflow.apache.org). These notes list 3.4.0 with a date of 2026-11-06 (airflow.apache.org/docs/apache-airflow/stable/release_notes.html). A follow-up PR, #76571 (github.com/apache/airflow/pull/76571), reports that a slow Execution API response can make the single-use token exchange fail, so a deadline callback is marked failed without running.

    For Storm, the ASF news page says the 3.1.0 release makes the state serializer require registered classes, a behaviour change that may require migrating existing checkpoints (storm.apache.org/news.html). The CNA-based record places the fix for CVE-2026-82440 in 3.1.0 (strix.ai).

    Remediation

    • Upgrade apache-airflow to 3.4.0 (securityonline.info; airflow.apache.org).
    • Restrict write access to the Celery broker to Airflow components only (securityonline.info).
    • Disable load_examples in production (securityonline.info).
    • Upgrade Storm to the 3.1.0 line per the ASF and the CNA record, and set an explicit scheduler strategy allowlist (storm.apache.org/news.html; strix.ai).
    • Until Storm is upgraded, restrict network and credential access to the state store to the cluster itself (storm.apache.org/news.html).
    • Rotate any secrets that may have reached audit logs before the upgrade (securityonline.info).

    Conflicting Reports

    • Storm fixed version: the article says Storm 3.2.0 is the fixed release. The ASF news page and the CNA-based records place the fix for CVE-2026-82436 and CVE-2026-82440 in 3.1.0 (storm.apache.org/news.html; strix.ai). The vendor's version is used here, and the 3.2.0 figure is unverified.
    • Severity: the article rates CVE-2026-82436 as high. Apache has published no CVSS score for any of the flaws, and the CNA-based records show severity as unscored (strix.ai). VulDB labels CVE-2026-68982 as critical while listing no vendor score (vuldb.com). The vendor's status (unscored) is used here.