EUVD-2026-23658
GHSA-6ffj-2wg2-w45j
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.
Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
AnalysisAI
Deserialization vulnerability in Apache Airflow webserver (all versions before 3.2.0) allows network-accessible attackers to execute arbitrary code by injecting malicious XCom payloads, despite vendor-assigned Low severity due to the trusted Dag Author threat model. CVSS 9.8 Critical rating reflects unauthenticated network-based RCE capability (AV:N/PR:N), contradicting the description's trust assumption. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit all Airflow webserver instances for version <3.2.0 and assess network exposure (restrict webserver access to trusted internal networks only via firewall/WAF rules). Within 7 days: Patch all affected Airflow deployments to version 3.2.0 or later per vendor advisory. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today