Apache Airflow API server unsafe XCom deserialization

A task author can run their own programs on the workflow tool's server.

Summary

Apache Airflow's Task Execution API stores task-written XCom values without the reserved-key check, so a Dag author can make the API server create airflow.* classes with chosen arguments. Versions 3.0.0 before 3.4.0 are affected, and the earlier fix in 3.3.1 does not close this route.

Affected when

deserialization enabled in the API

What to do

Update to apache-airflow 3.4.0 or later. The earlier fix in 3.3.1 does not cover this route.

Products and platforms

Apache Airflow

CVE IDs

CVE-2026-111421 (opens in a new tab)

Sources

Advisory: lists.apache.org (opens in a new tab)
CVE record: cve.org (opens in a new tab)
Discussion: CVE-2026-111421: Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server (opens in a new tab)

Times

First published 2026-11-09 07:22 UTC

First seen 2026-11-09 12:16 UTC