{"metadata": {"vulnerability": "CVE-2026-68982", "count": 23, "kinds": {"milestone": 5, "sighting": 8, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-02T00:09:01.550Z", "date_only": false, "value": "2026-08-02T00:09:01.550Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-68982", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "vulnerabilities.12.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T09:55:00.238Z", "date_only": false, "value": "2026-11-09T09:55:00.238Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-68982", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T09:59:45.070Z", "date_only": false, "value": "2026-11-09T09:59:45.070749Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117585896051680522", "record": "CVE-2026-68982", "field": "creation_timestamp", "uuid": "a2903bce-c6c9-4ecd-aee3-6bc659cf53ce", "content": "CVE-2026-68982 Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.\nhttps://www.cve.org/CVERecord?id=CVE-2026-68982https://github.com/apache/airflow/pull/71192https://www.cve.org/CVERecord?id=CVE-2020-11981https://github.com/apache/airflow/pull/70927https://lists.apache.org/thread.html/7t514l87nhjworv2ns22b8ltxr1f7rhg#apache #ApacheSoftwareFoundation #ApacheAirflow#CVE_2026_68982#bot", "url": "https://infosec.exchange/users/cve/statuses/117585896051680522"}, {"timestamp": "2026-11-09T10:17:11Z", "date_only": false, "value": "2026-11-09T10:17:11Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3M38-QXXM-8G9G", "record": "GHSA-3M38-QXXM-8G9G", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T10:17:11.123Z", "date_only": false, "value": "2026-11-09T10:17:11.123", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-68982", "record": "FKIE_CVE-2026-68982", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:31:41Z", "date_only": false, "value": "2026-11-09T12:31:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3M38-QXXM-8G9G", "record": "GHSA-3M38-QXXM-8G9G", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:31:41Z", "date_only": false, "value": "2026-11-09T12:31:41Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3M38-QXXM-8G9G", "record": "GHSA-3M38-QXXM-8G9G", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T13:05:04.432Z", "date_only": false, "value": "2026-11-09T13:05:04.432Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-68982", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T13:05:04.432Z", "date_only": false, "value": "2026-11-09T13:05:04.432Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-68982", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T13:17:08.620Z", "date_only": false, "value": "2026-11-09T13:17:08.620", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-68982", "record": "FKIE_CVE-2026-68982", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T00:40:35.755Z", "date_only": false, "value": "2026-11-10T00:40:35.755830Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzw7dsqvsm2i", "record": "CVE-2026-68982", "field": "creation_timestamp", "uuid": "6e758cb5-ab81-4647-8398-b0a12fc35898", "content": "18 Apache Airflow vulnerabilities, including Celery code execution CVE-2026-68982, are fixed in Airflow 3.4.0, plus two Apache Storm flaws.\n\n#ApacheAirflow #ApacheStorm #CVE202668982 #DataPipeline #Deserialization #SecretsLeak #PatchNow #Vulnerability", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzw7dsqvsm2i"}, {"timestamp": "2026-11-10T10:14:01.543Z", "date_only": false, "value": "2026-11-10T10:14:01.543+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-10T10:31:56.969Z", "date_only": false, "value": "2026-11-10T10:31:56.969405Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mzxaf7yyh226", "record": "CVE-2026-68982", "field": "creation_timestamp", "uuid": "5f6a7c63-46bd-457a-8433-553031330549", "content": "Apache Airflow\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\n\nApache Airflow\u306eCeleryExecutor\u306b\u8a8d\u8a3c\u6b20\u5982\u306e\u6b20\u9665\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002Celery\u30d6\u30ed\u30fc\u30ab\u30fc\u3078\u306e\u66f8\u304d\u8fbc\u307f\u6a29\u9650\u3092\u6301\u3064\u8005\u3067\u3042\u308c\u3070\u8ab0\u3067\u3082\u3001\u3059\u3079\u3066\u306e\u30ef\u30fc\u30ab\u30fc\u4e0a\u3067\u4efb\u610f\u306ePython\u547c\u3073\u51fa\u3057\u53ef\u80fd\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u300cCVE-2026-68982\u300d\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u304a\u308a\u3001CWE-306\uff08\u91cd", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mzxaf7yyh226"}, {"timestamp": "2026-11-10T11:58:03.764Z", "date_only": false, "value": "2026-11-10T11:58:03.764171Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mzxf7acsdo2m", "record": "CVE-2026-68982", "field": "creation_timestamp", "uuid": "58d6921a-e2e5-4cc9-a5ff-1933e43d09b1", "content": "Apache Airflow\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\u300cCVE-2026-68982\u300d\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\n\nApache Airflow\u306b\u3001\u8a8d\u8a3c\u306e\u6b20\u5982\u306b\u8d77\u56e0\u3059\u308b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002\u653b\u6483\u8005\u306fAirflow\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u6301\u305f\u306a\u304f\u3066\u3082\u3001Celery\u30ef\u30fc\u30ab\u30fc\u4e0a\u3067\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306fCVE-2026-68982\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u304a\u308a\u3001CWE-306\u306b\u5206\u985e\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u5f71\u97ff\u3092\u53d7\u3051\u308b\u306e\u306f\u3001CeleryExecutor", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mzxf7acsdo2m"}, {"timestamp": "2026-11-10T12:00:23.216Z", "date_only": false, "value": "2026-11-10T12:00:23.216831Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lrbilool.bsky.social/post/3mzxfdf3btt2g", "record": "cve-2026-68982", "field": "creation_timestamp", "uuid": "3060d676-9350-4c0a-9dcb-bee199e5f7db", "content": "\ud83d\udea8 Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenti\u2026\n\n\ud83d\udcf0 GBHackers \u00b7 Nov 10, 19:49\n#CyberSecurity #Vulnerability \n\n\ud83d\udcd6 Full story: https://gbhackers.com/critical-apache-airflow-flaw-cve-2026-68982-enables-unauthenticated-remote-code-execution/\n\ud83d\udce3 More on Telegram: https://t.me/hackernewer", "url": "https://bsky.app/profile/lrbilool.bsky.social/post/3mzxfdf3btt2g"}, {"timestamp": "2026-11-10T12:05:43Z", "date_only": false, "value": "2026-11-10T12:05:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/18919", "record": "CVE-2026-68982", "field": "creation_timestamp", "uuid": "98560423-45f7-46dc-b6d4-15749769baff", "content": "Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution \u2013 gbhackers.com\n\nTue, 10 Nov 2026 19:49:08", "url": "https://t.me/MalaysiaHacktivistz/18919"}, {"timestamp": "2026-11-10T12:05:43Z", "date_only": false, "value": "2026-11-10T12:05:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/28353", "record": "CVE-2026-68982", "field": "creation_timestamp", "uuid": "fd88cdb6-dcd8-49ba-bb0d-ac81e6662da3", "content": "Critical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution \u2013 gbhackers.com\n\nTue, 10 Nov 2026 19:49:08", "url": "https://t.me/MalaysiaHacktivistz/28353"}, {"timestamp": "2026-11-10T13:24:08.478Z", "date_only": false, "value": "2026-11-10T13:24:08.478888Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mzyousbe6s2p", "record": "CVE-2026-68982", "field": "creation_timestamp", "uuid": "aa699b22-cee7-4031-a764-440ffa087751", "content": "Tuesday's fuck up - Again Apache - \u200aCritical Apache Airflow Flaw CVE-2026-68982 Enables Unauthenticated Remote Code Execution\n\ngbhackers.com/critical-apa... #redteam #cve #rce #critical #apache #airflaw", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mzyousbe6s2p"}], "metrics": {"as_of": "2026-11-10T18:14:36.324Z", "anchors": {"origin": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 155676.324396, "hours": 43.243423443333334, "days": 1.801809310138889, "min_seconds": 155676.324396, "max_seconds": 155676.324396, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-10T18:14:36.324Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}