CVE-2026-25917CWE-502

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

High · published April 18, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01117 · 65.8th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-04-18T06:20Z
EPSS history
Timeline
  • 18 APR 06:20Z
    Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)
    cvelistv5