← voltar
CVE-2026-33858

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

CVSS 8.8 HIGHEPSS 0.6%CWE-502
Vexday Risk Score
21Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 8.8EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
13 abr 2026Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache Airflow
Referências
https://github.com/apache/airflow/pull/64148https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0http://www.openwall.com/lists/oss-security/2026/04/13/7