PT-2026-32992 · Apache · Apache Airflow

Vincent55 Yang · CVE-2025-54550 · Published 2026-04-15 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow (affected versions not specified)

Description An example named 'example xcom' in the documentation implemented an unsafe pattern for reading values from XCom. This could allow a UI user with permissions to modify XComs to execute arbitrary code on the worker. XCom is a mechanism that allows tasks to exchange small amounts of data.

Recommendations Users who implemented the pattern found in the 'example xcom' example should adjust their implementations to match the improved version provided in the Airflow 3.2.0 documentation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-AIRFLOW-2025-54550

CVE-2025-54550

ECHO-968F-A05C-4A8B

GHSA-Q2HG-643C-GW8H

PYSEC-2026-2353

Affected Products

Apache Airflow

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54550.json · Exploit
• https://github.com/apache/airflow/pull/63200 · Patch
• https://osv.dev/vulnerability/GHSA-q2hg-643c-gw8h · Vendor Advisory
• https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54550 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2025-54550 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54550 · Vendor Advisory
• https://github.com/apache/airflow · Note
• http://openwall.com/lists/oss-security/2026/04/15/1 · Note
• https://pypi.org/project/apache-airflow · Note
• https://pypi.python.org · Note
• https://twitter.com/oss_security/status/2044454208707928315 · Twitter Post
• https://twitter.com/CVEnew/status/2044338855588036998 · Twitter Post
• https://github.com/advisories/GHSA-q2hg-643c-gw8h · Note