CVE-2026-33858
Arbitrary Code Execution via XCom Payload in Apache Airflow
Publication date: 2026-04-13
Last updated on: 2026-04-17
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | airflow | From 3.1.8 (inc) to 3.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows Dag Authors, who normally should not be able to execute code in the webserver context, to craft an XCom payload that causes the webserver to execute arbitrary code.
Since Dag Authors are already highly trusted users, the severity of this issue is considered low.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows Dag Authors to execute arbitrary code in the webserver context by crafting malicious XCom payloads. Although Dag Authors are already highly trusted, this could potentially lead to unauthorized actions or data exposure within the Apache Airflow environment.
Given the high CVSS score (8.8) indicating high impact on confidentiality, integrity, and availability, this vulnerability could pose risks to compliance with standards such as GDPR or HIPAA, which require strict controls over data access and system integrity.
However, since the vulnerability is limited to highly trusted users (Dag Authors), the direct impact on compliance depends on the organization's internal trust and access policies. Organizations should consider this risk in their compliance assessments and apply the recommended upgrade to Apache Airflow 3.2.0 to mitigate the issue.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a Dag Author to execute arbitrary code within the webserver context of Apache Airflow.
This could potentially lead to unauthorized actions being performed on the webserver, but since Dag Authors are already highly trusted, the overall risk and impact are low.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are recommended to upgrade to Apache Airflow version 3.2.0, which contains the fix addressing this issue.