AIKIDO-2026-67318

TL;DR

The Task SDK rebuilds a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because the callback class passes the default deserialization allow-list, tightening that setting does not help. A Dag author who controls a task instance's next_kwargs can cause an arbitrary module to be imported inside the scheduler when its timeout sweep deserializes that value. The fix stops reconstructing the callback through unrestricted import.