Apache Airflow scheduler deserializes task-controlled XCom values (CVE-2026-86829)
Original title: CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Dag authors control XCom values that the scheduler fully deserializes during dependency evaluation.
Apache Airflow's scheduler deserializes XCom values written by task code while evaluating task dependencies. This gives a Dag author control over data deserialized inside the scheduler process, a context reserved for Deployment Manager code. The issue affects Apache Airflow before 3.4.0.
- scheduler fully deserializes XCom values written by task code
- Dag author controls what a task writes to XCom
- controls data deserialized inside the scheduler process
- context reserves for code installed by the Deployment Manager
- above the...
Impact: arbitrary data in scheduler process
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86829 | XCom deserialization in Apache Airflow scheduler | — | <1% | PoC |
From the original article
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.