# CVE-2026-111421: Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/594) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-111421-apache-airflow-execution-api-set-xcom-skips-the-reserved-key-che-c7cca9f2d3ce944f
Kind: security · Impact: medium

## In brief

- Apache Airflow's Task Execution API stored task-written XCom values without the reserved-key check that is applied elsewhere.
- As a result, task-written XComs can instantiate airflow.* classes on the API server.
- Affected versions are Apache Airflow 3.0.0 before 3.4.0; the source rates severity as moderate.

## Why it matters

Deployments of Apache Airflow 3.0.0 to before 3.4.0 can have the API server instantiate airflow.* classes from task-written XComs, so teams running those versions should upgrade.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow 3.0.0
- Apache Airflow 3.4.0

## CVEs

- CVE-2026-111421

## Timeline

- 2026-11-08: Vulnerability posted to oss-sec by Rahul Vats

## Coverage

- [CVE-2026-111421: Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server](https://seclists.org/oss-sec/2026/q4/594) — Open Source Security, 2026-11-09

Tags: airflow, security, vulnerability, xcom, apache, cve-2026-111421

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev