PT-2026-32371 · Apache · Apache Airflow

Amogh Desai + 1 · CVE-2026-33858 · Published 2026-04-13 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0

Description Dag Authors can craft a malicious XCom payload that allows them to execute arbitrary code within the webserver context, bypassing the standard restriction that prevents them from executing code in that environment.

Recommendations Upgrade to Apache Airflow 3.2.0.

Exploit

Fix

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-AIRFLOW-2026-33858

BIT-AIRFLOW-2026-42359

CVE-2026-33858

ECHO-A0AC-41BB-A272

GHSA-MC4F-R875-V87W

GHSA-WR76-29CR-67W8

PYSEC-2026-185

PYSEC-2026-20

Affected Products

Apache Airflow

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33858.json · Exploit
• https://github.com/apache/airflow/pull/64148 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33858 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42359 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-20 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wr76-29cr-67w8 · Vendor Advisory
• https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mc4f-r875-v87w · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33858 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33858 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-33858 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-185 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-42359 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/pull/65915 · Note