The vulnerability exists in Apache Airflow’s scheduler-side deadline‑reference decoder. During deserialization of a custom reference it imports a class path supplied by a DAG author without any allowlist or plugin‑registry check. The imported class is instantiated with a live SQLAlchemy session, giving the attacker the ability to execute arbitrary code with the scheduler’s privileges. This flaw is a classic deserialization weakness (CWE‑502).

Apache Software Foundation releases of Apache Airflow deployed on single‑host or shared‑scheduler setups are impacted. Versions prior to 3.2.2 lack the necessary guard and must be upgraded to release 3.2.2 or newer to apply the fix.

No EPSS score is reported, and the flaw is not listed in the CISA KEV catalog, so the exploitation probability cannot be quantified. The vulnerability requires that the attacker can supply DAG code that runs on the scheduler process, which is typically the case on single‑host deployments where the DAG bundle is importable. This implies a local or user‑controlled code injection vector that can lead to remote code execution if the attacker can influence DAG content. The impact is significant as it grants full control over the scheduler process and, by extension, the entire Airflow environment.