CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafka event producer — dagruneventsenabled or taskinstanceeventsenabled, both disabled by default — build that client inside the scheduler process, so a user whose only privilege is editing Airflow connections gains arbitrary code execution in the control plane; the Airflow security model limits connection-configuration users to code execution on workers, not the scheduler. Deployments using Google Managed Kafka are not affected, because that code path overwrites any user-supplied oauthcb; plain brokers and Amazon MSK are exposed. Users are recommended to upgrade to apache-airflow-providers-apache-kafka 2.0.0 or later, which adds an allowlist configuration option for connection-string callbacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-apache-kafkato a version that resolves this vulnerability.Fixed in 2.0.0 - Configuration
Ensure Kafka event producer settings are disabled in the scheduler process by leaving `dag_run_events_enabled` and `task_instance_events_enabled` set to false (both are disabled by default).
Apache Airflow Apache Kafka provider dag_run_events_enabled / task_instance_events_enabled = false - Compensating control
If using plain brokers or Amazon MSK, mitigate by restricting Airflow connection-editor access so that users who can edit Airflow connections (and configure Kafka connection callbacks) cannot reach the scheduler control plane.
Event History
Frequently Asked Questions
Is a default Airflow deployment exposed to scheduler-side code execution?
No. The affected scheduler code path is used only when dag_run_events_enabled or task_instance_events_enabled is enabled; both settings are disabled by default.
What access does an attacker need to exploit this issue?
The attacker needs permission to edit Airflow connections and must be able to place a dotted Python path in the Kafka connection extra configuration. No broader scheduler-level privilege is required.
Which Kafka deployments are affected?
Deployments using plain Kafka brokers or Amazon MSK are exposed when the Kafka event producer is enabled. Google Managed Kafka is not affected because its code path replaces a user-supplied oauth_cb value.
What should teams do to remediate or reduce exposure?
Upgrade apache-airflow-providers-apache-kafka to version 2.0.0 or later, which adds an allowlist configuration option for connection-string callbacks. Until then, disabling the Kafka event producer prevents the described scheduler client construction path.