Apache Airflow Task SDK reconstructs a Callback object from serialized data by re-running its constructor, importing the module named by the callback path. Because the SyncCallback class is within Airflow itself, it passes the default allowed‑deserialization classes allow‑list, so tightening that setting does not mitigate the flaw. A DAG author—who can supply arbitrary next_kwargs through the task execution API—can therefore trigger the scheduler to import an arbitrary module when the scheduler’s unconditionally running timeout sweep deserializes that value. This ability to load and execute code in the scheduler process constitutes direct remote code execution.

Apache Airflow versions 3.3.0 and any versions following until 3.3.1 are affected; prior to 3.3.0 versions are not vulnerable. The flaw is tied to the scheduler sweep that first appears in 3.3.0, and the upstream advisory recommends upgrading to 3.3.1 or later to remove the vulnerability.

The CVSS score is 8.8 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. An attacker who can author DAGs or manipulate a task’s next_kwargs can trigger an arbitrary module import in the scheduler, giving them full code execution privileges on the host. The flaw does not require any configuration changes; exploitation will occur whenever the scheduler performs its standard sweep. Given the critical nature of the code executed inside the scheduler, the risk of successful exploitation is high for any environment where DAG authors are not tightly restricted.