description: An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
problem types: Remote Code Execution
affected:
{
product: Apache Airflow
vendor: Apache Software Foundation
versions:
status: affected, version: 1.10.10 and below
}