CVE-2026-31072

No fix known EPSS <1%CVSS 9.8

The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers

Published 2026-05-19 · CVE record · OSV

Products: Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Satellite 6

Fixed upstream

Distro releases