AIKIDO-2026-405583

TL;DR

Airflow's serialization layer reconstructs exception objects from serialized task state by passing a class path from the payload into import_string(). A crafted payload can point that path at an arbitrary importable class, so deserializing it imports and instantiates attacker-influenced code instead of a real Airflow exception. This can lead to full compromise of the process handling the deserialized state. The fix restricts exception reconstruction to a safe, allow-listed set of classes.