Unauthenticated RCE in Apache Airflow Exposes Worker Nodes via Exposed Redis Brokers
Written by AI from the linked story. Not reviewed by an editor. How this works
A critical flaw (CVE-2026-68982) in Apache Airflow allows attackers with write access to an exposed Celery message broker—such as an unauthenticated Redis instance—to execute arbitrary code on worker nodes without any credentials. The root vulnerability is insufficient validation of 'ExecuteCallback' messages, enabling arbitrary module imports and execution within the worker environment. This is compounded by the widespread practice of leaving Redis brokers internet-exposed without authentication, dramatically lowering the bar for exploitation. With a CVSS-equivalent score of 9.8, this represents a near-worst-case scenario: a remotely reachable, unauthenticated code execution path in widely deployed workflow automation infrastructure.
Tactical Insight
Immediate actions
- Upgrade Apache Airflow to version 3.4.0 or later to remediate CVE-2026-68982.
- Audit all Redis (and other message broker) instances and enforce authentication immediately, removing any internet-facing exposure.
- Restrict network access to Celery broker endpoints so only authorised Airflow components can reach them.
Long-term improvements
- Maintain a continuous inventory of all middleware and message broker dependencies, including their authentication configuration.
- Implement automated vulnerability scanning for all data-pipeline and orchestration components as part of your patch management programme.
- Apply network segmentation so worker nodes and brokers reside in isolated network zones unreachable from untrusted networks.
Detection measures
- Monitor Celery broker traffic for unexpected message types or anomalous module-import activity on worker nodes.
- Alert on any unauthenticated connections or failed authentication attempts to Redis or other message broker endpoints.
- Integrate threat intelligence feeds for Apache ecosystem CVEs to trigger emergency patch workflows when critical advisories are published.