CVE-2026-31072 APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
Attackers can achieve remote code execution in applications using APScheduler by submitting crafted JSON or CBOR payloads to vulnerable serializers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31072?
CVE-2026-31072 is a critical unsafe deserialization vulnerability in n/a, published on 19 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers
Weakness: CWE-502
Which versions are affected by CVE-2026-31072?
3 open source packages ship an affected version, including apscheduler.
| Package | Affected | Fixed in |
|---|---|---|
apscheduler PyPI | From 4.0.0a1 to 4.0.0a6 | None |
apscheduler PyPI | From 4.0.0a1 to 4.0.0a6 | None |
apscheduler PyPI | From 4.0.0a1 to 4.0.0a6 | None |
How do I fix CVE-2026-31072?
No fix has been published for CVE-2026-31072 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-31072 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31072 exists.
Sources
Also known as GHSA-9cfw-f3f9-7mm7, PYSEC-2026-282.