{"metadata": {"vulnerability": "CVE-2026-82337", "count": 21, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 14}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-28T16:01:53.743Z", "date_only": false, "value": "2026-08-28T16:01:53.743Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-82337", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "vulnerabilities.14.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T07:33:49.216Z", "date_only": false, "value": "2026-11-09T07:33:49.216586Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/coyse3qv3dkbq", "record": "CVE-2026-82337", "field": "creation_timestamp", "uuid": "5bf3af54-6712-4a08-8e9b-2f8e66814783", "content": "CVE-2026-82337: Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/coyse3qv3dkbq"}, {"timestamp": "2026-11-09T09:51:35.992Z", "date_only": false, "value": "2026-11-09T09:51:35.992Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-82337", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T09:51:35.992Z", "date_only": false, "value": "2026-11-09T09:51:35.992Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-82337", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T09:54:03.865Z", "date_only": false, "value": "2026-11-09T09:54:03.865242Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117585873682832646", "record": "CVE-2026-82337", "field": "creation_timestamp", "uuid": "3e79def4-cb2d-478a-af61-85a183b439a5", "content": "CVE-2026-82337 Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected.\nThis is an incomplete fix of CVE-2026-45360, which only hardened the `reference` field; deployments that applied that fix remain affected through the `callback` and `interval` fields.\nUsers of apache-airflow are recommended to upgrade to 3.4.0 or later.\nhttps://www.cve.org/CVERecord?id=CVE-2026-82337https://github.com/apache/airflow/pull/72651https://github.com/apache/airflow/pull/74830https://www.cve.org/CVERecord?id=CVE-2026-45360https://lists.apache.org/thread.html/9v8f3hlm6pxbwl2jt1c2bw84s80gg6kp#cve #apache #ApacheSoftwareFoundation #ApacheAirflow#CVE_2026_82337#bot", "url": "https://infosec.exchange/users/cve/statuses/117585873682832646"}, {"timestamp": "2026-11-09T10:17:11Z", "date_only": false, "value": "2026-11-09T10:17:11Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5G3C-4F7X-QXVX", "record": "GHSA-5G3C-4F7X-QXVX", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T10:17:11.467Z", "date_only": false, "value": "2026-11-09T10:17:11.467", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82337", "record": "FKIE_CVE-2026-82337", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T12:31:41Z", "date_only": false, "value": "2026-11-09T12:31:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5G3C-4F7X-QXVX", "record": "GHSA-5G3C-4F7X-QXVX", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-12T08:07:02.635Z", "date_only": false, "value": "2026-11-12T08:07:02.635+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-12T19:51:47.868Z", "date_only": false, "value": "2026-11-12T19:51:47.868990Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-82337", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-11-12T19:51:47.868Z", "date_only": false, "value": "2026-11-12T19:51:47.868990Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82337", "record": "FKIE_CVE-2026-82337", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-12T19:52:10.738Z", "date_only": false, "value": "2026-11-12T19:52:10.738Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-82337", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T19:52:10.738Z", "date_only": false, "value": "2026-11-12T19:52:10.738Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-82337", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T20:18:51.920Z", "date_only": false, "value": "2026-11-12T20:18:51.920", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82337", "record": "FKIE_CVE-2026-82337", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T21:30:43Z", "date_only": false, "value": "2026-11-12T21:30:43Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5G3C-4F7X-QXVX", "record": "GHSA-5G3C-4F7X-QXVX", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T15:53:41.052Z", "anchors": {"origin": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 406421.052275, "hours": 112.89473674305556, "days": 4.703947364293982, "min_seconds": 406421.052275, "max_seconds": 406421.052275, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4401", "record": "WID-SEC-W-2026-4401", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-13T15:53:41.052Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}