APACHE-AIRFLOW · CVE-2026-111421 · Runtime
NO FIX YET · SEE WHAT TO DO
A Dag author's task could write a crafted XCom value that, when viewed through the Airflow API with deserialization enabled, makes the API server instantiate classes from the airflow.* namespace with attacker-chosen arguments. This is an incomplete fix for CVE-2026-59242, and apache-airflow 3.3.1 users who applied that fix remain exposed.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Airflow 3.x whose Dag authors can write tasks and whose API server reads XComs with deserialization enabled. Installations where only trusted authors write Dags, or where deserialization is off, face less exposure. The sources do not state the exact default configuration.
Not affected if deserialization-disabled, trusted-dag-authors
Who cares apache-airflow, python, self-hosted
airflow version or pip show apache-airflow, and see whether it is 3.3.1 or earlier in the 3.x line.3.4.0 or laterApache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the airflow.* namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.