Arbitrary Code Execution via Unsafe Deserialization in Airflow Scheduler

Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Apache Airflow's scheduler contains an unsafe deserialization vulnerability in the `SerializedCustomReference.deserialize_reference` method that allows arbitrary code execution. The flaw stems from the scheduler importing and dispatching arbitrary class paths from DAG-author-controlled serialized state without validation, allowlisting, or plugin-registry controls. This is particularly critical in single-host deployments where DAGs are importable from the scheduler process itself. A malicious DAG author can embed a custom `DeadlineReference` object whose serialized form references attacker-controlled modules, leading to remote code execution on the scheduler—a high-privilege component that orchestrates all workflow execution. Organizations using Airflow for data pipelines, ML workflows, or infrastructure automation face direct compromise of their scheduler infrastructure and cascading impact to downstream systems.

Casky's 419 matched skills detect this vulnerability through Claude AI's extended reasoning applied to three critical MITRE ATT&ACK techniques: TA0001 (Initial Access) - identifying how malicious DAG uploads breach the scheduler; TA0043 (Reconnaissance) - mapping the deserialization gadget chains and module-loading patterns; and TA0002 (Execution) - pinpointing unsafe `__import__()` and `getattr()` calls during deserialization. Practitioners using Casky would observe findings highlighting suspicious imports of arbitrary modules during DAG parsing, detection of serialized objects with dynamic class resolution patterns, and behavioral anomalies where the scheduler spawns unexpected child processes. The platform would flag unsafe pickle or serialization patterns, missing input validation on class path references, and the absence of plugin-registry enforcement—enabling teams to distinguish this deserialization attack from legitimate workflow execution and implement immediate remediation through serialization allowlisting.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45360.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-45360

Casky has 419 skills that investigate the attack patterns behind CVE-2026-45360. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn