Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 13, 2026 · NIST NVD

   Detected

   Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.

2. Jun 17, 2026 · NIST NVD

   Updated

   Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.

Affected

• cpe apache/airflowversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-33858

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33858

  Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apach

  nvd.nist.gov

References

• Mailing List · openwall.com
• Issue Tracking · github.com
• Mailing List · lists.apache.org