Log in Start free

Vulnerability · Published May 19, 2026 · Assigned by mitre

CVE-2026-31072

Critical 9.8

In plain English

A critical-severity unsafe deserialization in the apscheduler package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 42.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12apschedulerno fix listedDEBIAN-CVE-2026-31072
Debian:13apschedulerno fix listedDEBIAN-CVE-2026-31072
Debian:14apschedulerno fix listedDEBIAN-CVE-2026-31072
PyPIapschedulerno fix listedGHSA-9cfw-f3f9-7mm7
PyPIapschedulerno fix listedPYSEC-2026-282
Ubuntu:22.04:LTSapschedulerno fix listedUBUNTU-CVE-2026-31072
Ubuntu:24.04:LTSapschedulerno fix listedUBUNTU-CVE-2026-31072
Ubuntu:25.10apschedulerno fix listedUBUNTU-CVE-2026-31072
Ubuntu:26.04:LTSapschedulerno fix listedUBUNTU-CVE-2026-31072

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References