9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31072

CVE-2026-31072: APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling setstate on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31072

CVE-2026-31072:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apscheduler	pip	>= 4.0.0a1, <= 4.0.0a6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists within the custom object serialization/deserialization logic implemented in APScheduler's JSONSerializer and CBORSerializer. The root cause is the unmarshal_object function in src/apscheduler/_marshalling.py. This function insecurely reconstructs Python objects from serialized data. It dynamically resolves a class from a string reference provided in the payload, instantiates it, and then calls its __setstate__ method with attacker-controlled data. This pattern is a classic example of CWE-502: Deserialization of Untrusted Data.

The JSONSerializer and CBORSerializer use this vulnerable unmarshal_object function within their respective deserialization hooks (_object_hook for JSON and _tag_hook for CBOR). When an application using these serializers deserializes a specially crafted payload, the hooks identify a special marker (a key for JSON, a tag for CBOR) and divert the data to unmarshal_object. This allows an attacker to instantiate any class available in the application's scope and call its __setstate__ method, leading to Remote Code Execution if a suitable gadget class (e.g., one that executes system commands) is present.

Vulnerable functions

unmarshal_object

src/apscheduler/_marshalling.py

This function is the core of the vulnerability. It takes a string reference to a class, dynamically imports and resolves it using `callable_from_ref`, creates a new instance of the class, and then calls `__setstate__` with attacker-controlled data. This allows for arbitrary object instantiation and state injection, which can be leveraged for Remote Code Execution (RCE) if a suitable 'gadget' class is available in the Python environment.

JSONSerializer._object_hook

src/apscheduler/serializers/json.py

This method is used as a hook in the `json.loads` function. It checks for a special key (`_apscheduler_json`) in the JSON object. If found, it extracts the class reference and state, and passes them directly to the vulnerable `unmarshal_object` function, thereby triggering the insecure deserialization.

JSONSerializer.deserialize

src/apscheduler/serializers/json.py

This is the public entry point for the JSON deserialization process. It calls `json.loads` with the custom `_object_hook` which contains the vulnerable logic. An attacker would target this function by providing a malicious JSON payload.

CBORSerializer._tag_hook

src/apscheduler/serializers/cbor.py

This method is used as a hook in the `cbor2.loads` function. It checks for a specific CBOR tag. If the tag matches, it extracts the class reference and state from the CBOR data and passes them to the vulnerable `unmarshal_object` function, triggering the insecure deserialization.

CBORSerializer.deserialize

src/apscheduler/serializers/cbor.py

This is the public entry point for the CBOR deserialization process. It calls `cbor2.loads` with the custom `_tag_hook` which contains the vulnerable logic. An attacker would target this function by providing a malicious CBOR payload.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.