Database/Control plane, storage & DevOps
Apache Airflow: a crafted XCom payload makes the webserver execute code in its own context
Impact
A DAG author can craft an XCom payload that causes the Airflow webserver to execute arbitrary code when the value is rendered, reaching a context DAG authors are not supposed to execute in. On a fleet where Airflow drives training and data pipelines, that moves an author from worker-level execution to the webserver process, which typically holds the Airflow metadata database credentials and connection secrets for storage and clusters. Apache rates the severity low because DAG authors are already highly trusted; the value is in knowing the author/webserver boundary does not hold, which matters if DAG authoring is delegated more widely than cluster administration.
Who can reach it
An authenticated DAG author - someone who can add or modify a DAG that runs in the environment. Not reachable by a UI user without DAG authoring rights.
What to do
Upgrade to Apache Airflow 3.2.0, which resolves the issue; this is a scheduler and webserver upgrade with a service restart, no node drain. Until then treat DAG authoring as equivalent to webserver access and scope who may commit DAGs accordingly.
References
Related entries
- Apache ActiveMQ: Improper input validation and code injection in the brokerCVE-2026-34197 · Apache ActiveMQHigh
- Supermicro SMASH service (X14DBG-DAP, X14DBI): An attacker with any authorised BMC login escalates through the SMASHCVE-2026-3821 · Supermicro SMASH service (X14DBG-DAP, X14DBI)High
- Ceph RGW: unauthenticated STS token encryption lets any token holder bit-flip themselves to RGW adminCVE-2026-39944 · Ceph RADOS Gateway (STS session token AES-128-CBC handler)High
- MinIO (S3 API, Snowball auto-extract): The Snowball auto-extract path skips signature verification entirely, so anCVE-2026-40344 · MinIO (S3 API, Snowball auto-extract)High
- MinIO (S3 API, unsigned-trailer uploads): The signature on a query-string-credential unsigned-trailer upload is notCVE-2026-41145 · MinIO (S3 API, unsigned-trailer uploads)High
- JFrog Artifactory: token scope not validated, allowing privilege escalation from any low-privileged tokenCVE-2026-42016 · JFrog Artifactory Self-Hosted (access token scope validation)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.