{"id":"CVE-2026-111421","kind":"vulnerability","aliases":["CVE-2026-111421"],"related":[],"title":"Apache Airflow: task-written XComs can make the API server instantiate arbitrary airflow classes","description":"Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later.","summary":"A Dag author's task could write a crafted XCom value that, when viewed through the Airflow API with deserialization enabled, makes the API server instantiate classes from the airflow.* namespace with attacker-chosen arguments. This is an incomplete fix for CVE-2026-59242, and apache-airflow 3.3.1 users who applied that fix remain exposed.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apache-airflow","fixed":[],"affected":"","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["apache-airflow","python","runtime","self-hosted"],"not_affected_if":["deserialization-disabled","trusted-dag-authors"],"how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`, and see whether it is `3.3.1` or earlier in the 3.x line.\n- Confirm whether XCom deserialization is enabled on the API server (the sources do not name the setting; unknown).","fix":"- apache-airflow: upgrade to `3.4.0` or later","status":"open","published_at":"2026-11-09T10:17:03+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:51+00:00","updated_at":"2026-11-09T10:26:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T10:26:51Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow: upgrade to `3.4.0` or later","reach":"network","title":"Apache Airflow: task-written XComs can make the API server instantiate arbitrary airflow classes","impact":"high","summary":"A Dag author's task could write a crafted XCom value that, when viewed through the Airflow API with deserialization enabled, makes the API server instantiate classes from the airflow.* namespace with attacker-chosen arguments. This is an incomplete fix for CVE-2026-59242, and apache-airflow 3.3.1 users who applied that fix remain exposed.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-airflow","self-hosted","python"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"API server instantiates attacker-chosen airflow classes with chosen arguments","analyst_note":"Confirm the default for XCom deserialization and the exact affected range at https://nvd.nist.gov/vuln/detail/CVE-2026-111421 and the Airflow security advisory.","how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`, and see whether it is `3.3.1` or earlier in the 3.x line.\n- Confirm whether XCom deserialization is enabled on the API server (the sources do not name the setting; unknown).","plain_action":"","product_name":"apache-airflow","needs_analyst":true,"not_affected_if":["trusted-dag-authors","deserialization-disabled"],"who_is_affected":"Teams running Apache Airflow 3.x whose Dag authors can write tasks and whose API server reads XComs with deserialization enabled. Installations where only trusted authors write Dags, or where deserialization is off, face less exposure. The sources do not state the exact default configuration.","user_interaction":"yes","product_ecosystem":"pypi","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4624,"output_tokens":682,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111421':18A,21A '-2026':17A,20A,76B,157C '-59242':77B,158C '3.3.1':82B,168C '3.4.0':181C 'affect':170C 'airflow':2A,14A,24A,27B,49B,62B,81B,91C,142C,167C,180C 'apach':1A,26B,80B,90C,166C,179C 'apache':23A 'apache-airflow':22A,25B,79B,165C,178C 'api':10A,50B,56B,95C,130C,136C 'appli':85B,109C,161C 'arbitrari':13A 'argument':68B,145C 'attack':66B 'attacker-chosen':65B 'author':35B,114C,148C 'check':108C 'chose':149C 'chosen':67B 'class':15A,59B,139C 'could':38B,117C 'craft':41B 'cve':16A,19A,75B,156C 'dag':34B,113C,147C 'deseri':52B,132C 'elsewher':110C 'enabl':53B,133C 'execut':94C 'expos':89B 'fix':73B,87B,154C,163C 'host':32B 'incomplet':72B,153C 'instanti':12A,58B,138C 'key':107C 'later':125C,183C 'made':134C 'make':8A,54B 'namespac':63B,143C 'python':28B 'remain':88B,169C 'reserv':106C 'reserved-key':105C 'rout':173C 'runtim':29B 'self':31B 'self-host':30B 'server':11A,57B,137C 'store':96C 'task':4A,37B,93C,102C,116C 'task-written':3A 'upgrad':176C 'user':83B,124C,159C 'valu':43B,98C 'view':46B,126C 'without':103C 'write':39B,118C 'written':5A,99C 'xcom':6A,42B,97C,120C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow 3.x whose Dag authors can write tasks and whose API server reads XComs with deserialization enabled. Installations where only trusted authors write Dags, or where deserialization is off, face less exposure. The sources do not state the exact default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheairflow"],"ptokens":["airflow","apache"],"labels":["apacheairflow","high","pypi","python","runtime","selfhosted"],"campaign_type":null,"search_a":"'-111421':18A,21A '-2026':17A,20A 'airflow':2A,14A,24A 'apach':1A 'apache':23A 'apache-airflow':22A 'api':10A 'arbitrari':13A 'class':15A 'cve':16A,19A 'instanti':12A 'make':8A 'server':11A 'task':4A 'task-written':3A 'written':5A 'xcom':6A","search_b":"'-2026':76B '-59242':77B '3.3.1':82B 'airflow':27B,49B,62B,81B 'apach':26B,80B 'apache-airflow':25B,79B 'api':50B,56B 'appli':85B 'argument':68B 'attack':66B 'attacker-chosen':65B 'author':35B 'chosen':67B 'class':59B 'could':38B 'craft':41B 'cve':75B 'dag':34B 'deseri':52B 'enabl':53B 'expos':89B 'fix':73B,87B 'host':32B 'incomplet':72B 'instanti':58B 'make':54B 'namespac':63B 'python':28B 'remain':88B 'runtim':29B 'self':31B 'self-host':30B 'server':57B 'task':37B 'user':83B 'valu':43B 'view':46B 'write':39B 'xcom':42B","search_c":"'-2026':157C '-59242':158C '3.3.1':168C '3.4.0':181C 'affect':170C 'airflow':91C,142C,167C,180C 'apach':90C,166C,179C 'apache-airflow':165C,178C 'api':95C,130C,136C 'appli':109C,161C 'argument':145C 'author':114C,148C 'check':108C 'chose':149C 'class':139C 'could':117C 'cve':156C 'dag':113C,147C 'deseri':132C 'elsewher':110C 'enabl':133C 'execut':94C 'fix':154C,163C 'incomplet':153C 'instanti':138C 'key':107C 'later':125C,183C 'made':134C 'namespac':143C 'remain':169C 'reserv':106C 'reserved-key':105C 'rout':173C 'server':137C 'store':96C 'task':93C,102C,116C 'upgrad':176C 'user':124C,159C 'valu':98C 'view':126C 'without':103C 'write':118C 'written':99C 'xcom':97C,120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111421","severity":null,"published_at":"2026-11-09T10:17:03+00:00","modified_at":"2026-11-09T10:17:03+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}