Deserialization of Untrusted Data in Apache Airflow - CVE-2026-33858
Published: August 25, 2026
Vulnerability identifier: #VU145317
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33858
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code in the webserver context.
The vulnerability exists due to unsafe deserialization in the XCom API when processing crafted XCom payloads containing legacy serialization keys. A remote user can craft a malicious XCom payload to execute arbitrary code in the webserver context.
The issue affects Dag Authors who normally should not be able to execute code in the webserver context.
Affected software
Apache Airflow
How to mitigate CVE-2026-33858
Install security update from vendor's website.
Apache Airflow - update to 3.2.0