Vulnerabilities

TI-2026-26224 CVE-2026-33858 · GHSA-mc4f-r875-v87w

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (type/var) Bypass in XCom API

MEDIUM 41

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00592 Published 2026-04-13 Fixed in 3.2.0 CWE-502

TI-2025-40728 CVE-2025-66236 · GHSA-j86x-fwp2-qh7v

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

LOW 39

Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00439 Published 2026-04-13 Fixed in 3.2.0 CWE-532

Vulnerabilities

Filters

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (type/var) Bypass in XCom API