EUVD-2026-57312
GHSA-fcmm-42r9-mmmm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable REST API requires authenticated low-privilege user with XCom write-and-read access; primary impact is credential confidentiality via Connection class instantiation, with limited integrity exposure and no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Apache Airflow's XCom GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize_value without the _check_forbidden_xcom_keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow.* classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with deserialize=true triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.
Articles & Coverage 1
AnalysisAI
Unsafe deserialization in Apache Airflow's XCom REST API allows an authenticated user with XCom write-and-read access to instantiate arbitrary airflow.* classes on the API server by smuggling reserved serialization keys inside JSON string literals. The _check_forbidden_xcom_keys guard inspected dict, list, and tuple types but did not attempt to JSON-decode str values, so a payload like json.dumps({"__classname__": "airflow.sdk.definitions.connection.Connection"}) passed the write-time check and was later reconstructed into a live Python object when read back via ?deserialize=true. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Airflow API session with at minimum two specific permissions: XCom write access (to POST or PATCH an XCom entry with a reserved-key payload encoded as a JSON string literal) and XCom read access (to trigger deserialization by appending `?deserialize=true` to the GET request). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector or EPSS score is provided in the available data, so risk signals must be inferred entirely from the description and PR diff. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid Airflow API account possessing XCom write-and-read permissions crafts a POST request to the XCom entries endpoint, submitting a value of `json.dumps({"__classname__": "airflow.sdk.definitions.connection.Connection", "__var": {}})` - a string that passes the forbidden-key guard because the guard does not inspect string contents. The attacker then issues `GET .../xcomEntries/{key}?deserialize=true`, causing the API server to re-parse the string into a dict and pass it to `BaseXCom.deserialize_value`, which instantiates the `Connection` class and potentially exposes stored credentials or connection metadata embedded in the resulting object. |
| Remediation | Upgrade to apache-airflow 3.3.1 or later, which incorporates the fix from PR #69378 and rejects reserved XCom serialization keys submitted as JSON string literals at write time (HTTP 422 returned). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Apache Airflow deployments and document current versions; review XCom REST API access logs and user permissions to identify who holds write-and-read access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today