Apache Airflow 3.4.0 and Storm 3.2.0 Fix 20 Vulnerabilities, Including Code Execution Flaws

TL;DR

The Apache Software Foundation disclosed 20 security flaws on November 9, 2026. Eighteen affect Apache Airflow, and two affect Apache Storm. These Apache Airflow vulnerabilities range from leaked secrets to code execution on Celery workers. Five of the 20 are rated high severity.

Airflow 3.4.0 fixes deserialization, authorization and secret-masking bugs, including one that lets anyone with Celery broker access run code. Meanwhile, two Storm flaws allow unsafe deserialization and class loading. Upgrade both platforms now.

Notable CVEs

Why It Matters

Airflow runs data pipelines that hold database passwords, cloud keys and API tokens. So a single masking or authorization gap can expose credentials across an organization. Similarly, Storm clusters process real-time data streams for many teams.

So far, no exploitation in the wild and no public proof-of-concept have been confirmed for any of the 20 flaws.

By the numbers

• High: 5 (four in Airflow, one in Storm)
• Medium: 7
• Low: 8
• CVSS scores: none published yet; ratings come from Apache

How the Attacks Work

Airflow code execution paths

The most serious bug, CVE-2026-68982, sits in the CeleryExecutor. It ran deadline-alert callbacks “without validating the workload’s authentication token.” As a result, “anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker.” Next, CVE-2026-86829 lets a Dag author push XCom data that the scheduler fully deserializes. In addition, CVE-2026-82337 lets a Dag author construct allowed classes inside the scheduler and API server.

Airflow secret leaks

Several bugs expose credentials. For example, CVE-2026-76185 lets a Dag author read another team’s secrets in multi-team setups. Likewise, CVE-2026-107474 returned Apprise notification credentials in cleartext through the connections API. Other flaws missed camelCase key names, nested values and some CLI arguments when masking secrets in logs.

Apache Storm

CVE-2026-82436 (high) affects stateful bolt checkpoints. Storm’s DefaultStateSerializer “deserialized whatever bytes the state store returned” with Kryo class registration disabled. Separately, CVE-2026-82440 let topologies name any scheduler strategy class, because an unset allowlist was treated as “allow any class.”

Affected Versions

• Apache Airflow before 3.4.0
• Apache Storm releases before the fixed 3.2.0 line

Some Airflow bugs only matter in specific setups, such as multi-team mode, deadline alerts or loaded example Dags. For instance, CVE-2026-101031 affects only deployments that load the bundled example Dags.

Patch and Mitigation

• Upgrade to apache-airflow 3.4.0, described in the Apache Airflow 3.4.0 release post.
• Lock down your Celery broker so only Airflow components can write to it.
• Disable load_examples in production.
• Get the latest Storm release from the Apache Storm downloads page, and set an explicit scheduler strategy allowlist.
• Rotate any secrets that may have reached audit logs before the upgrade.

Taken together, these Apache Airflow vulnerabilities show how pipeline platforms concentrate credentials, so patch them promptly.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.