HIGH 8.8 NVD
CVE-2026-111421
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later.
References
- https://github.com/apache/airflow/pull/72718
- https://github.com/apache/airflow/pull/74829
- https://lists.apache.org/thread.html/pwdwx354tv0x3m8wzfhh59r6wyztj2lk
- https://www.cve.org/CVERecord?id=CVE-2026-59242
- https://www.openwall.com/lists/oss-security/2026/11/09/14
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.