NVD HIGH: CVE-2026-58076 — Apache Airflow's serialization layer reconstructed exception nodes by calling `i...
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoke
CVE-2026-58076