CVE-2026-33858CWE-502

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

High · published April 13, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
64.2
In the wild
Unconfirmed
What it is

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01058 · 64.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-04-13T14:36Z
EPSS history
Timeline
  • 13 APR 14:36Z
    Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
    cvelistv5