CVE Watch9 de nov. de 2026

CVE-2026-68982

Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workloa

CVSS

—

Sem CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 9 de nov. de 2026 · Última mod.: 9 de nov. de 2026 · CWE-306

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-112170—

—

———The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.2h CVE-2026-118461—

—

———The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.3h CVE-2026-1245785.3 MÉD

—

———A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.7h CVE-2026-1245737.3 ALT

—

———A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.8h CVE-2026-1201136.4 MÉD

—

——0IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.21h CVE-2026-1235305.9 MÉD

18.1%

——5Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.2d