--- cve: "CVE-2026-86792" severity: "LOW" cvss: 3.1 epss: "45%" vendor: "Apache Software Foundation" kev: false exploited: false published: "2026-09-16 10:16:55" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-18T05:41:56+02:00" --- # CVE-2026-86792 > 3.1 LOW · 🧪 PoC ## Beschreibung Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafka event producer — `dag_run_events_enabled` or `task_instance_events_enabled`, both disabled by default — build that client inside the scheduler process, so a user whose only privilege is editing Airflow connections gains arbitrary code execution in the control plane; the Airflow security model limits connection-configuration users to code execution on workers, not the scheduler. Deployments using Google Managed Kafka are not affected, because that code path overwrites any user-supplied `oauth_cb`; plain brokers and Amazon MSK are exposed. Users are recommended to upgrade to apache-airflow-providers-apache-kafka 2.0.0 or later, which adds an allowlist configuration option for connection-string callbacks. ## Patch verfügbar (OSV) - 8217db8cb4b1ff302c5cf8662477ac00f701e78c (Commit) ## Referenzen - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-86792) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_