{"id":"CVE-2026-86829","kind":"vulnerability","aliases":["CVE-2026-86829"],"related":[],"title":"Apache Airflow: scheduler deserializes task-written XCom values, letting DAG authors escalate","description":"Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than Deployment Managers are affected, and the scheduler must be evaluating a task dependency that reads a task-written XCom value. Users of apache-airflow are recommended to upgrade to version 3.4.0 or later, which restricts dependency evaluation to primitive XCom values.","summary":"Apache Airflow's scheduler fully deserializes XCom values that task code writes while it checks task dependencies. A DAG author, who should only control worker-level execution, can therefore feed crafted data into code running inside the scheduler process.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","data-pipelines","package","python","self-hosted"],"not_affected_if":["fully-trusted-dag-authors","no-xcom-dependencies"],"how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`\n- Check whether any task dependency reads a task-written XCom value (for example a dependency or sensor that calls XCom pull), since the scheduler must evaluate such a dependency to be exposed\n- Check whether DAG authors are trusted less than Deployment Managers in your deployment","fix":"- apache-airflow: upgrade to `3.4.0` or later, which restricts dependency evaluation to primitive XCom values","status":"open","published_at":"2026-11-09T10:17:13+00:00","first_seen_at":"2026-11-09T10:25:50+00:00","triaged_at":"2026-11-09T10:26:30+00:00","updated_at":"2026-11-09T10:26:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:30Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow: upgrade to `3.4.0` or later, which restricts dependency evaluation to primitive XCom values","reach":"network","title":"Apache Airflow: scheduler deserializes task-written XCom values, letting DAG authors escalate","impact":"high","summary":"Apache Airflow's scheduler fully deserializes XCom values that task code writes while it checks task dependencies. A DAG author, who should only control worker-level execution, can therefore feed crafted data into code running inside the scheduler process.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-airflow","python","self-hosted","data-pipelines"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"DAG author runs code inside the Airflow scheduler process","analyst_note":"","how_to_check":"- Check the installed version with `airflow version` or `pip show apache-airflow`\n- Check whether any task dependency reads a task-written XCom value (for example a dependency or sensor that calls XCom pull), since the scheduler must evaluate such a dependency to be exposed\n- Check whether DAG authors are trusted less than Deployment Managers in your deployment","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fully-trusted-dag-authors","no-xcom-dependencies"],"who_is_affected":"Deployments that treat DAG authors as less trusted than Deployment Managers are affected, and only when the scheduler evaluates a task dependency that reads an XCom value written by task code. Deployments where DAG authors are fully trusted, or where no dependency reads task-written XCom values, have less exposure and can plan the upgrade normally.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4678,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-86829':16A,19A '3.4.0':177C 'affect':148C 'airflow':2A,22B,32B,72C,111C,170C 'apach':1A,21B,31B,71C,169C 'apache-airflow':20B,168C 'author':12A,50B,89C,131C,140C 'capabl':128C 'check':45B 'code':41B,65B,82C,116C 'context':109C 'control':54B,91C,99C 'craft':62B 'cve':14A,17A 'dag':11A,49B,88C,130C,139C 'data':24B,63B,100C 'data-pipelin':23B 'depend':47B,86C,157C,182C 'deploy':120C,136C,145C 'deseri':4A,36B,76C,103C 'document':133C 'escal':13A 'evalu':84C,154C,183C 'execut':58B,127C 'feed':61B 'fulli':35B,75C 'host':30B 'insid':67B,104C 'instal':117C 'later':179C 'less':142C 'let':10A 'level':57B 'manag':121C,146C 'model':113C 'must':152C 'packag':26B 'pipelin':25B 'primit':185C 'process':70B,107C 'python':27B 'read':159C 'recommend':172C 'reserv':114C 'restrict':181C 'run':66B 'schedul':3A,34B,69B,74C,106C,151C 'scope':126C 'secur':112C 'self':29B 'self-host':28B 'task':6A,40B,46B,81C,85C,94C,156C,162C 'task-written':5A,161C 'therefor':60B,98C 'treat':138C 'trust':143C 'upgrad':174C 'user':166C 'valu':9A,38B,78C,165C,187C 'version':176C 'worker':56B,125C 'worker-level':55B 'worker-scop':124C 'write':42B,95C 'written':7A,79C,163C 'xcom':8A,37B,77C,97C,164C,186C","nicknames":[],"mitigations":[],"who_affected":"Deployments that treat DAG authors as less trusted than Deployment Managers are affected, and only when the scheduler evaluates a task dependency that reads an XCom value written by task code. Deployments where DAG authors are fully trusted, or where no dependency reads task-written XCom values, have less exposure and can plan the upgrade normally.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","datapipelines","high","package","python","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-86829':16A,19A 'airflow':2A 'apach':1A 'author':12A 'cve':14A,17A 'dag':11A 'deseri':4A 'escal':13A 'let':10A 'schedul':3A 'task':6A 'task-written':5A 'valu':9A 'written':7A 'xcom':8A","search_b":"'airflow':22B,32B 'apach':21B,31B 'apache-airflow':20B 'author':50B 'check':45B 'code':41B,65B 'control':54B 'craft':62B 'dag':49B 'data':24B,63B 'data-pipelin':23B 'depend':47B 'deseri':36B 'execut':58B 'feed':61B 'fulli':35B 'host':30B 'insid':67B 'level':57B 'packag':26B 'pipelin':25B 'process':70B 'python':27B 'run':66B 'schedul':34B,69B 'self':29B 'self-host':28B 'task':40B,46B 'therefor':60B 'valu':38B 'worker':56B 'worker-level':55B 'write':42B 'xcom':37B","search_c":"'3.4.0':177C 'affect':148C 'airflow':72C,111C,170C 'apach':71C,169C 'apache-airflow':168C 'author':89C,131C,140C 'capabl':128C 'code':82C,116C 'context':109C 'control':91C,99C 'dag':88C,130C,139C 'data':100C 'depend':86C,157C,182C 'deploy':120C,136C,145C 'deseri':76C,103C 'document':133C 'evalu':84C,154C,183C 'execut':127C 'fulli':75C 'insid':104C 'instal':117C 'later':179C 'less':142C 'manag':121C,146C 'model':113C 'must':152C 'primit':185C 'process':107C 'read':159C 'recommend':172C 'reserv':114C 'restrict':181C 'schedul':74C,106C,151C 'scope':126C 'secur':112C 'task':81C,85C,94C,156C,162C 'task-written':161C 'therefor':98C 'treat':138C 'trust':143C 'upgrad':174C 'user':166C 'valu':78C,165C,187C 'version':176C 'worker':125C 'worker-scop':124C 'write':95C 'written':79C,163C 'xcom':77C,97C,164C,186C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86829","severity":null,"published_at":"2026-11-09T10:17:13+00:00","modified_at":"2026-11-09T10:17:13+00:00","first_seen_at":"2026-11-09T10:25:50+00:00","fetched_at":"2026-11-09T10:25:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}