Security · High impactFan score 21 · Tier C
CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
The Brief
- Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.
- A Dag author who controls what a task writes can exploit this, per the advisory's description.
- Affected versions are Apache Airflow before 3.4.0; the advisory is tracked as CVE-2026-86829 and rated important.
Why it matters
Deployments running affected Airflow versions may let Dag authors trigger unsafe deserialization inside the scheduler, so upgrading removes this exposure.
Who’s affected
- Teams running Apache Airflow before 3.4.0
- Operators of Airflow schedulers that run untrusted or third-party Dags
What to do
- Upgrade Apache Airflow to 3.4.0 or later
- Apache Airflow 3.4.0
- CVE-2026-86829
- #apache-airflow
- #security
- #cve
- #deserialization
- #scheduler
- #xcom
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes…
Timeline
Vulnerability posted to oss-sec by Rahul Vats
Open Source Security
CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation