{"action":"Upgrade apache-airflow-providers-apache-kafka to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"1.15.0"}],"component":"apache-airflow-providers-apache-kafka","cve_ids":["CVE-2026-86792"],"ecosystem":"PyPI","epss":0.01189,"exploited":false,"fixed_versions":["2.0.0"],"id":"tcs_01M5KH93C3HTE6Z576ZH9ENRGK","modified_at":"2026-09-19T23:00:02.763316321Z","published_at":"2026-09-16T10:16:55.060Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3986","http://www.openwall.com/lists/oss-security/2026/09/15/15","https://lists.apache.org/thread/jl4gpok02313yh3rvtvj8qbo11c6zpr2","https://lists.apache.org/thread/jl4gpok02313yh3rvtvj8qbo11c6zpr2?users@airflow.apache.org","https://github.com/apache/airflow/pull/72208"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-3986","url":"https://osv.dev/vulnerability/PYSEC-2026-3986"}],"summary":"Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist,"}