Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the BaseXCom.deserializevalue. An attacker can execute arbitrary code on the API server by submitting specially crafted JSON string literals to the GET /api/v2/.../xcomEntries/key?deserialize=true...

EUVD-2026-57312

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the XCom API. A privileged DAG Author can execute code on the webserver by invoking a class via legacy serialization keys type/var. Details Serialization is a process of converting an object into a...

Deserialization of Untrusted Data

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the XCom API. A privileged DAG Author can execute code on the...

CVE-2026-33858

The Apache Airflow webserver is vulnerable to Remote Code Execution (RCE) due to unsafe deserialization via legacy serialization keys (__type__, __var) in the XCom API . An attacker with Dag Author privileges can craft a malicious XCom payload that, when processed by the webserver, leads to arbit...