# CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/589) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-86829-apache-airflow-deserialization-of-task-controlled-xcom-values-in-d28c956794324d01
Kind: security · Impact: high

## In brief

- Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.
- A Dag author who controls what a task writes can exploit this, per the advisory's description.
- Affected versions are Apache Airflow before 3.4.0; the advisory is tracked as CVE-2026-86829 and rated important.

## Why it matters

Deployments running affected Airflow versions may let Dag authors trigger unsafe deserialization inside the scheduler, so upgrading removes this exposure.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow 3.4.0

## CVEs

- CVE-2026-86829

## Timeline

- 2026-11-08: Vulnerability posted to oss-sec by Rahul Vats

## Coverage

- [CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation](https://seclists.org/oss-sec/2026/q4/589) — Open Source Security, 2026-11-09

Tags: apache-airflow, security, cve, deserialization, scheduler, xcom

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev