BIT-airflow-2026-25917

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2026-25917.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-airflow-2026-25917
Aliases
Published
2026-04-21T12:01:27.677Z
Modified
2026-04-23T09:16:07.221921Z
Summary
Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)
Details

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

Database specific 
{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:apache:airflow:*:*:*:*:*:python:*:*"
    ]
}
References

Affected packages

Bitnami / airflow

Package

Name
airflow
Purl
pkg:bitnami/airflow

Severity

  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2026-25917.json"