198 matches found
Exploit for CVE-2026-86829
CVE-2026-86829 — Apache Airflow scheduler RCE via XCom deseria...
CVE-2026-86829
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...
CVE-2026-111421
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the...
CVE-2026-86829
The Apache Airflow scheduler is vulnerable to a security bypass because it fully deserializes XCom values written by task code during task dependency evaluation. This allows a Dag author to control data deserialized within the scheduler process, exceeding their intended worker-scoped execution ca...
EUVD-2026-119903
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...
CVE-2026-86829
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...
CVE-2026-86829 Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...
CVE-2026-86829 Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...
CVE-2026-111421
Apache Airflow is vulnerable to an incomplete fix for CVE-2026-59242 due to the Task Execution API storing XCom values without the required reserved-key check . A Dag author can craft a task to write an XCom that, when viewed via the API with deserialization enabled , forces the API server to ins...
EUVD-2026-119890
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the...
CVE-2026-111421
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the...
PT-2026-140320
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.4.0 Description The scheduler fully deserializes XCom values written by task code during the evaluation of task dependencies. This allows a DAG author to control data that is deserialized within the scheduler...
CVE-2026-111421: Apache Software Foundation Apache Airflow: Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied…
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the...
PT-2026-140276
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the...
CVE-2026-86829: Apache Software Foundation Apache Airflow: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...
CLEANSTART-2026-UI77772 Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team,...
Security vulnerability affects the airflow-3 package. Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site...
CLEANSTART-2026-ZO32580 Apache Airflow's XCom `GET /api/v2/{
Security vulnerability affects the airflow-3 package. Apache Airflow's XCom GET /api/v2/...
PT-2026-117928
Security vulnerability affects the airflow-3 package. Apache Airflow's XCom GET /api/v2/...
PT-2026-117871
Security vulnerability affects the airflow-3 package. Apache Airflow's asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until finished authorized the target Dag without its team, unlike every other authorization site...
BIT-AIRFLOW-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints
Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...