Apache Airflow 3.3.0 introduced a new awaiting_input state that is swept by the scheduler every fifteen seconds. During this sweep the scheduler blindly deserializes the task instance’s next_kwargs. Because the deserialization is not limited by an allow-list, an attacker who can set that value—such as a DAG author using the task execution API—can import an arbitrary module and instantiate objects inside the scheduler process, or even terminate the scheduler job. This flaw is a classic instance of untrusted deserialization and thus allows remote code execution without any special configuration changes.

The vulnerability applies exclusively to Apache Airflow version 3.3.0. Earlier releases are unaffected because human‑in‑the‑loop tasks were routed through the triggerer rather than the scheduler. Users who have applied the fix for CVE-2026-58076 must still update to Apache Airflow 3.3.1 or newer to address this distinct code path.

With a CVSS score of 7.3 the flaw is considered high severity, and the EPSS score is not available, indicating no current metric for exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by creating or modifying a DAG so that its next_kwargs payload contains malicious serialization, and then triggering the scheduler’s periodic sweep. No non‑default configuration is required; the deserialization path is executed unconditionally every fifteen seconds. Consequently, any Airflow instance running 3.3.0 without the update is at considerable risk of remote code execution.