CVE-2026-45360: Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Synopsis

An arbitrary import vulnerability exists in Apache Airflow's scheduler-side deadline-reference deserializer, reachable over the network without any authentication. The scheduler's `SerializedCustomReference.deserialize_reference` function accepts attacker-controlled class paths from DAG-serialized state and calls `import_string(...)` on them without an allowlist, instantiating arbitrary classes with a live SQLAlchemy session attached. Successful exploitation allows a DAG author to read data, modify database rows, or disrupt scheduler operation. A patched-image rebuild at version 3.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network (AV:N), so an attacker must be able to reach the Airflow scheduler service across the network to deliver malicious serialized DAG state.

• AuthenticationNot required

  No credentials are required (PR:N); any DAG author who can submit a DAG bundle to the scheduler can trigger the vulnerable deserialization path without holding a privileged account.

• Victim interactionNot required

  No user interaction is needed (UI:N); the scheduler processes the malicious serialized reference automatically during its normal scheduling cycle.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond submitting a DAG with a crafted DeadlineReference.

Blast Radius

• Reads data accessible via the attached SQLAlchemy session, including DAG metadata, connection credentials stored in Airflow's metadata database, and variable values.
• Modifies or deletes persisted rows in the Airflow metadata database, including task instances, DAG runs, and stored connections or variables.
• Crashes or destabilizes the scheduler process by instantiating a class that raises an unhandled exception, disrupting pipeline scheduling across all DAGs on the deployment.
• Establishes a foothold for further lateral movement if the attacker-controlled class performs outbound network calls or writes files accessible to other scheduler processes.