Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 18, 2026 · NIST NVD

   Detected

   Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

2. Jun 17, 2026 · NIST NVD

   Updated

   Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

Affected

• cpe apache/airflowversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-25917

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-25917

  Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache

  nvd.nist.gov

References

• Mailing List · openwall.com
• Issue Tracking · github.com
• Mailing List · lists.apache.org