PYSEC-2026-3992

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

CVE-2026-59242

Apache Airflow's XCom "GET /api/v2/.../xcomEntries/key?deserialize=true" endpoint passed a string-literal payload through "BaseXCom.deserializevalue" without the "checkforbiddenxcomkeys" guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary "airflow."...