Advisoriesby IbisApache AirflowPYSEC-2026-13
Apache Airflow: code execution
Fix: upgrade to 3.2.0 or later
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.
Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 3.2.0 | 3.2.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the CVSS score
- Also known as
- BIT-airflow-2026-25917, CVE-2026-25917, GHSA-6ffj-2wg2-w45j, PYSEC-2026-2359
More Apache Airflow advisories
All Apache Airflow
Apache Airflow Exposes Secrets in Variables Saved as JSON DictionariesCVE-2026-32690fixed in 3.2.0In case of SQL errorsCVE-2026-30912fixed in 3.2.0Apache Airflow: JWT token appearing in logsCVE-2026-31987fixed in 3.2.0Apache Airflow: RCE by race condition in example_xcom dagCVE-2025-54550fixed in 3.2.0Apache Airflow: information disclosureCVE-2026-25219fixed in 3.1.8Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APICVE-2026-33858fixed in 3.2.0