CVE-2026-33858

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33858
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33858.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33858
Aliases
Downstream
Published
2026-04-13T14:36:30.956Z
Modified
2026-07-15T01:49:08.484493946Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
Details

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33858.json",
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/airflow

Affected ranges

Type
GIT
Repo
https://github.com/apache/airflow
Events
Introduced
27f9660ab259e27157e6814310e9e4dc19e8be08
Fixed
37069948c093e4b6720ec4821ff0ed7d6c069935
Database specific 
{
    "extracted_events": [
        {
            "introduced": "3.1.8"
        },
        {
            "fixed": "3.2.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33858.json"