CVE-2026-111421

HIGH 8.8

Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later.

CWE	CWE-502
Vendor	apache software foundation
Product	apache airflow
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow

Be the first to know when new high vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow

3.0.0 < 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/72718 github.com: https://github.com/apache/airflow/pull/74829 cve.org: https://www.cve.org/CVERecord?id=CVE-2026-59242 lists.apache.org: https://lists.apache.org/thread.html/pwdwx354tv0x3m8wzfhh59r6wyztj2lk

Credits

Qi Qin of depthfirst Hama1cco Zhixi "Jace" Sun, independent security researcher Michael Lip (theluckystrike) Jarek Potiuk