Critical Apache Airflow RCE Flaw Allows Unauthenticated Code Execution via Celery

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-68982, has been discovered in Apache Airflow, impacting deployments utilizing the CeleryExecutor. This flaw allows attackers who possess write access to the Celery message broker to execute arbitrary code on worker nodes without requiring any authentication, credentials, or even a valid DAG.

The vulnerability, classified under CWE-306 for missing authentication for a critical function, affects Apache Airflow versions prior to 3.4.0 when configured with CeleryExecutor. While Airflow typically secures communication channels for task execution, the ExecuteCallback messages sent via the Celery broker lack proper validation. Unlike ExecuteTask messages, which are protected by signed JWTs and validated by the Execution API, ExecuteCallback messages are processed by the execute_workload Celery task without any signature, HMAC, or broker-side access controls.

Researchers from Reflectiz demonstrated that the execute_workload task deserializes the JSON body of these messages into typed objects based solely on their declared structure. In versions 3.2.1 and 3.3.0, the callback handler directly imports modules and calls functions specified in the malicious message. This allows an attacker to craft a message that, for instance, calls os.system with arbitrary shell commands, leading to full code execution on the worker node. The vulnerability was confirmed on Airflow versions 3.2.1 and 3.3.0.

The exploit is particularly concerning as it leaves no trace within Airflow's logs or database. Proof-of-concept attacks generated no new DagRuns or TaskInstances, and API queries for DAGs returned zero entries, effectively masking the intrusion. A demonstration successfully dumped the worker's hostname and all AIRFLOW__ environment variables, including sensitive Fernet keys, highlighting the potential for deep system compromise.

While Apache rates the flaw as 'Important' and has not published a formal CVSS score, Reflectiz assigned it a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), underscoring its severity. Their research also indicated that a significant number of publicly accessible Redis brokers used with Airflow and Celery clusters (198 out of 211) were found to be unauthenticated, suggesting a wide potential attack surface.

This vulnerability bears resemblance to CVE-2020-11981, an earlier issue where broker access also led to code execution on older Airflow versions. The newly discovered flaw, however, bypasses authentication mechanisms that were in place for other communication channels.

Apache Airflow 3.4.0, released on November 6, 2026, addresses this critical vulnerability. The fix requires the worker to redeem a single-use token with the Execution API before executing any callbacks. Users are strongly advised to upgrade to Airflow 3.4.0 or later. As a temporary mitigation, organizations should enforce authentication on their Celery brokers (e.g., Redis AUTH, RabbitMQ username/password) and restrict network access to broker ports (6379 for Redis, 5672 for RabbitMQ) from the internet.

Given that Airflow's UI does not log these malicious callbacks, security teams should actively audit broker traffic and monitor Celery worker process logs for any unexpected execute_workload messages. This incident serves as a stark reminder of the risks associated with misconfigured message brokers and the importance of timely patching, especially for critical infrastructure components like Apache Airflow.