Apache Airflow: task-written XCom makes the API server instantiate attacker-chosen airflow.* classes

Impact

Task-written XCom values skip the reserved-key check that is enforced elsewhere in the Task Execution API. When a user later views one of those values through the API with deserialization enabled, the API server instantiates classes from the airflow.* namespace using arguments the Dag author picked. The code runs inside the API server rather than in the sandboxed task, so a Dag author can act with the API server's privileges and reach the secrets and connections it holds. This route was left open by the fix for CVE-2026-59242, so deployments on apache-airflow 3.3.1 that patched for that advisory are still exposed. The record does not list concrete gadget classes, so how far this goes past instantiation is not established.

Who can reach it

An authenticated Dag author whose task can write XCom values, plus a user who later views that XCom through the API with deserialization enabled. Network access to the API is required.

What to do

Upgrade apache-airflow to 3.4.0 or later and restart the API server and the scheduler/worker components. Upgrading to 3.3.1 for CVE-2026-59242 is not enough. Until you can upgrade, keep XCom deserialization in the API disabled and restrict who can author Dags.

References

Related entries

• Airflow SSH provider: command injection through templated environment values in SSHRemoteJobOperatorCVE-2026-111422 · Apache Airflow SSH provider (SSHRemoteJobOperator templated environment)High
• Atlantis: shell metacharacters in a pull request workspace name run commands as the Atlantis service accountCVE-2026-116676 · Atlantis (Terraform PR automation server, workspace name handling)High
• Jenkins: XStream deserialization filter not applied to resolves-to classesCVE-2026-117612 · Jenkins controller (XStream deserialization filter, resolves-to attribute)High
• Jenkins: unvalidated agent name lets a read-only user load and overwrite arbitrary config.xml on the controllerCVE-2026-117616 · Jenkins controller (agent-by-name HTTP endpoint)High
• Jenkins: low-privilege user can seed Manage Old Data warnings that overwrite user accounts including passwordsCVE-2026-117620 · Jenkins controller ("Manage Old Data" migration feature)High
• Jenkins: root element check bypass allows nesting types meant to live only in top-level config filesCVE-2026-117624 · Jenkins controller (XStream root element check for top-level configuration types)High