Apache Airflow CeleryExecutor Unauthenticated RCE via Forged Broker Callback (CVE-2026-68982)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5642 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-68982 Airflow Worker Context Downloader / Reverse Shell / Staging - Post-Exploitation (SPL)

Detects downloader, reverse shell, base64 decode and payload staging command lines (curl/wget piped to a shell or written to /tmp, /dev/tcp, nc -e, bash -i, mkfifo, base64 -d, python socket one-liners, chmod of files in /tmp) executed as the Airflow service account or under a Celery worker. Covers follow-on activity after a forged ExecuteCallback achieves code execution (CVE-2026-68982, TL-2026-5642), where real attacks substitute arbitrary commands for the PoC touch command.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1059.006, T1105, T1095, T1140, T1222.002
• Data sources: sysmon_for_linux, linux_process_creation, defender_for_endpoint_linux
• Severity: high
• Confidence: medium

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 (User="airflow" OR ParentCommandLine="*celery*worker*" OR ParentCommandLine="*execute_workload*")
```TL-2026-5642 / CVE-2026-68982 post-exploitation: downloader (T1105), reverse shell (T1095), decode (T1140) or chmod staging (T1222.002) in the Airflow worker context```
| where match(CommandLine,"(?i)((curl|wget) [^|]*[|] *(ba|da|z)?sh|(curl|wget) .*(-o|-O|--output) +/(tmp|dev/shm|var/tmp)/|/dev/tcp/|nc +-[ec] |ncat .*(-e|--exec)|bash +-i|mkfifo|base64 +(-d|--decode)|python[0-9.]* +-c .*socket|chmod +[+]?[0-7ax]+ +/(tmp|dev/shm|var/tmp)/)")
| eval technique=case(match(CommandLine,"(?i)(curl|wget)"),"T1105 ingress tool transfer",match(CommandLine,"(?i)(/dev/tcp/|nc +-[ec] |ncat|bash +-i|mkfifo|socket)"),"T1095 non-application layer protocol",match(CommandLine,"(?i)base64"),"T1140 deobfuscate decode",match(CommandLine,"(?i)chmod"),"T1222.002 linux file permissions",true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as suspicious_commands values(ParentCommandLine) as parent_cmdline values(technique) as technique by host, User, Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User Image technique suspicious_commands parent_cmdline count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName =~ 'airflow' or (InitiatingProcessCommandLine has 'celery' and InitiatingProcessCommandLine has 'worker')
| where ProcessCommandLine matches regex @'(?i)((curl|wget) [^|]*[|] *(ba|da|z)?sh|(curl|wget) .*(-o|-O|--output) +/(tmp|dev/shm|var/tmp)/|/dev/tcp/|nc +-[ec] |ncat .*(-e|--exec)|bash +-i|mkfifo|base64 +(-d|--decode)|python[0-9.]* +-c .*socket|chmod +[+]?[0-7ax]+ +/(tmp|dev/shm|var/tmp)/)'
| extend Technique = case(
    ProcessCommandLine matches regex @'(?i)(curl|wget)', 'T1105 Ingress Tool Transfer',
    ProcessCommandLine matches regex @'(?i)(/dev/tcp/|nc +-[ec] |ncat|bash +-i|mkfifo|socket)', 'T1095 Non-Application Layer Protocol',
    ProcessCommandLine has 'base64', 'T1140 Deobfuscate/Decode Files',
    ProcessCommandLine has 'chmod', 'T1222.002 Linux File Permissions Modification',
    'Other')
| project Timestamp, DeviceName, AccountName, FileName, Technique, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Airflow Worker Context Downloader or Reverse Shell - CVE-2026-68982 Post-Exploitation
id: 8c2f4a19-6d7b-4e35-b0a1-9f3e5d7c1a02
status: experimental
description: Detects downloader, reverse shell, base64 decode and chmod staging command lines run as the Airflow account or under a Celery worker, the follow-on activity after a forged ExecuteCallback gives code execution (CVE-2026-68982, TL-2026-5642).
references:
    - https://www.reflectiz.com/blog/apache-airflow-cve-2026-68982/
    - https://www.cve.org/CVERecord?id=CVE-2026-68982
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.execution
    - attack.t1059.004
    - attack.t1059.006
    - attack.command-and-control
    - attack.t1105
    - attack.t1095
    - attack.defense-evasion
    - attack.t1140
    - attack.t1222.002
    - cve.2026-68982
logsource:
    category: process_creation
    product: linux
detection:
    selection_context_user:
        User: 'airflow'
    selection_context_parent:
        ParentCommandLine|contains|all:
            - 'celery'
            - 'worker'
    payload_download_pipe:
        CommandLine|re: '(?i)(curl|wget) [^|]*[|] *(ba|da|z)?sh'
    payload_download_stage:
        CommandLine|re: '(?i)(curl|wget) .*(-o|-O|--output) +/(tmp|dev/shm|var/tmp)/'
    payload_reverse_shell:
        CommandLine|contains:
            - '/dev/tcp/'
            - 'bash -i'
            - 'mkfifo'
            - 'nc -e '
            - 'ncat --exec'
    payload_decode:
        CommandLine|contains:
            - 'base64 -d'
            - 'base64 --decode'
    payload_staging:
        CommandLine|re: '(?i)chmod +[+]?[0-7ax]+ +/(tmp|dev/shm|var/tmp)/'
    condition: 1 of selection_context_* and 1 of payload_*
falsepositives:
    - DAGs that legitimately download artifacts with curl or wget and pipe them to a shell
    - Administrators troubleshooting from the airflow account
level: high

Known false positives:

• DAGs that legitimately fetch installers or artifacts with curl/wget and pipe them to a shell
• Administrators troubleshooting interactively as the airflow service account

Tuning notes: Change the service account name (airflow) to match your deployment. Allow-list known DAG download commands by exact CommandLine. Narrow to worker hosts only. Process creation only exposes the direct parent, so descendants of the shell are caught through the service-account match rather than lineage.

• 🔒 CVE-2026-68982 Airflow Celery Worker Spawns Shell via Forged ExecuteCallback - Exploitation (KQL) · unlock with TL Creds
• 🔒 CVE-2026-68982 Airflow Worker Context Downloader / Reverse Shell / Staging - Post-Exploitation (KQL) · unlock with TL Creds
• 🔒 CVE-2026-68982 Celery Broker (Redis 6379 / RabbitMQ 5672) Reached From Untrusted Host - C2 / Lateral Movement (KQL) · unlock with TL Creds
• 🔒 CVE-2026-68982 Airflow Celery Worker Spawns Shell via Forged ExecuteCallback - Exploitation (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-68982 Airflow Worker Context Downloader / Reverse Shell / Staging - Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-68982 Celery Broker (Redis 6379 / RabbitMQ 5672) Reached From Untrusted Host - C2 / Lateral Movement (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-68982 Airflow Celery Worker Spawns Shell via Forged ExecuteCallback - Exploitation (SPL) · unlock with TL Creds
• 🔒 CVE-2026-68982 Celery Broker (Redis 6379 / RabbitMQ 5672) Reached From Untrusted Host - C2 / Lateral Movement (SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5642.

Technical analysis

CVE-2026-68982 affects Apache Airflow deployments before 3.4.0 that use CeleryExecutor. Airflow's web UI and REST API reject unauthenticated users, and ExecuteTask workloads delivered through the Celery broker carry a signed token that the Execution API validates. ExecuteCallback workloads travel over the same broker and the same execute_workload Celery task, but no token check occurs before the callback runs. ExecuteCallback was introduced for synchronous Deadline Alert callbacks.

The execute_workload task converts any JSON body received from the broker into a typed workload object, with no signature, HMAC or broker-side access control. In the analysed versions the callback token is never verified: execute_callback_workload() in 3.2.1 and supervise_callback() / CallbackSubprocess in 3.3.0. The worker reads the function path and kwargs from the message, loads the function with import_module and getattr, and calls it immediately, so any importable module is reachable. Per the researcher, the handler registers on every CeleryExecutor worker once the Celery provider loads, even where Deadline Alerts are not used, although the feature is documented as experimental.

Proof of concept (as described by GBHackers and Reflectiz): the attacker forges a workload of type ExecuteCallback with an empty token and a callback path of os.system with a benign test command (touch /tmp/pwned_by_broker_callback), and submits it with Celery send_task('execute_workload', ...) to a Redis broker. No JWT, DAG, DagRun or scheduler is needed; in the lab the Airflow API showed zero DAGs, DagRuns and TaskInstances afterwards, so UI/API-based monitoring will not reveal the activity. The lab used Docker Compose with CeleryExecutor, Redis and PostgreSQL, on Airflow 3.2.1 and 3.3.0.

Precondition: the attacker must be able to write to the Celery broker (for example an unauthenticated or internet-exposed Redis on 6379 or RabbitMQ on 5672, or a network foothold with broker access). LocalExecutor and KubernetesExecutor are reported as out of scope.

The fix shipped in Airflow 3.4.0 (released 2026-11-06, PR apache/airflow#71192): the executor mints a callback-scoped, single-use token bound to the callback ID, and the worker redeems it with the API server (PATCH /callbacks/{callback_id}/run) before running the callback. The call atomically moves the callback from QUEUED to RUNNING, so replayed or forged messages for a callback that is already running or finished are refused (409). Both the Execution API server and every CeleryExecutor worker must be upgraded. Apache rates the issue 'Important' and had published no CVSS score at the time of the Reflectiz post; the 9.8 CVSS v3.1 score and vector below are Reflectiz's assessment. No in-the-wild exploitation is reported in the sources reviewed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059.004 Unix Shell; T1059.006 Python; T1106 Native API

Discovery

T1082 System Information Discovery

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552 Unsecured Credentials

Remediation

Patches

• Upgrade Apache Airflow to 3.4.0 or later on the Execution API server AND every CeleryExecutor worker (upgrading only one does not fix the issue); fix: apache/airflow#71192

Immediate actions

• Require authentication on the Celery broker (Redis AUTH or RabbitMQ username/password)
• Keep the broker off the public internet: do not expose 6379 (Redis) or 5672 (RabbitMQ)
• Restrict network access to the broker to the scheduler, API server and Celery workers only
• Review broker traffic for ExecuteCallback workloads the scheduler did not issue and review Celery worker process logs

Workarounds

• No earlier patched release exists; broker authentication and network isolation are the compensating controls
• Deployments using LocalExecutor or KubernetesExecutor are reported as outside the advisory's scope

Longer-term hardening

• Do not rely on the Airflow UI or REST API for detection: this attack creates no DagRun or TaskInstance
• Monitor worker hosts for unexpected child processes (shells, os.system activity) spawned by Celery worker processes
• Review the Airflow Security Model documentation for broker trust assumptions

Affected and fixed versions

• Apache Software Foundation — Apache Airflow (CeleryExecutor)
  Vulnerable versions: All versions before 3.4.0 using CeleryExecutor (confirmed on 3.2.1 and 3.3.0)
  Fixed in: 3.4.0

Timeline

Last updated 2026-11-11 · revalidated 1× · latest source

• 2026-07-01 Reflectiz Shodan research (July 2026; exact day not stated) finds 198 of 211 reachable Redis brokers in Airflow/Celery clusters answering without authentication.
• 2026-08-01 Or Sahar (Reflectiz) reports the issue to the Apache Airflow Security Team
• 2026-08-02 CVE-2026-68982 is reserved and credited to Or Sahar
• 2026-08-29 Pull request apache/airflow#71192 (single-use callback token for deadline callbacks) is merged
• 2026-11-06 Apache Airflow 3.4.0 is released with the callback token redemption fix; no earlier patched release exists
• 2026-11-09 Apache publishes the security advisory (rated Important) and Reflectiz publishes its technical write-up with a proof of concept
• 2026-11-10 GBHackers reports the flaw; no in-the-wild exploitation is reported in the source

Update history

• 2026-11-11 — Apache Airflow CeleryExecutor Unauthenticated RCE via execute_workload ExecuteCallback (CVE-2026-68982): What changed No severity, exploitability or status change; remains CRITICAL / POC_PUBLIC. The update adds demonstrated impact: a recorded demo dumped the worker hostname and all AIRFLOW__ environment variables, including the Fernet key.

Sources cited

• CVE-2026-68982 CVE Record CVE Program · Advisory · 2026-11-09
• Apache Airflow security advisory (dev mailing list thread) lists.apache.org · Advisory · 2026-11-09
• Reflectiz: Apache Airflow CVE-2026-68982 (Or Sahar) reflectiz.com · Research · 2026-11-09
• Apache Airflow 3.4.0 Release Notes airflow.apache.org · Vendor report · 2026-11-06
• apache/airflow PR #71192: single-use callback token for deadline callbacks GitHub · Code repository · 2026-08-29
• Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution (GBHackers) gbhackers.com · News · 2026-11-10

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Previous and next in vulnerability

• Notepad++ 8.9.9 Fixes 6 Vulnerabilities (Local Privilege Escalation, Command Dispatch, Heap Overflows in MIME Tools) - No CVEs Assigned Previous report
• SAP patches ICM2SHELL and PROXYGATE maximum severity flaws (CVE-2026-76964, CVE-2026-120017, CVE-2026-89103, CVE-2026-89126) Next report