CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

<p>Posted by Vincent Beck on Sep 15</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Airflow Apache Kafka provider (apache-airflow-providers-apache-kafka) 1.15.0 before 2.0.0<br /> <br /> Description:<br /> <br /> Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka <br /> connection&apos;s `extra` field into Pyt