PT-2026-32371 · Apache · Apache Airflow

Amogh Desai + 1 · Published 2026-04-13 · Updated 2026-04-16 · CVE-2026-33858

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0

Description Dag Authors can craft a malicious XCom payload that allows them to execute arbitrary code within the webserver context, bypassing the standard restriction that prevents them from executing code in that environment.

Recommendations Upgrade to Apache Airflow 3.2.0.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-AIRFLOW-2026-33858

CVE-2026-33858

GHSA-MC4F-R875-V87W

PYSEC-2026-20

Affected Products

Apache Airflow

References · 12

• https://github.com/apache/airflow/pull/64148 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2026-33858 · Vendor Advisory
• https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mc4f-r875-v87w · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-20 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33858 · Security Note
• https://github.com/apache/airflow · Note
• https://twitter.com/CVEnew/status/2043733035838054693 · Twitter Post
• https://twitter.com/oss_security/status/2043700251349983519 · Twitter Post
• https://twitter.com/CveFindCom/status/2043754214703185994 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043808961028059342 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/13/7 · Note