> CVE-2026-25917

« BACK_TO_HOME
PUBLISHED
2026-04-18 07:16
MODIFIED
2026-04-18 07:16
EPSS (Prob. Exploit)
1.12%
Top 34.1%
DATA SOURCES:
NVD 🔗 2026-04-18 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05 OSV 🔗 2026-09-13

> DESCRIPTION

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-502

> CWE DETAILED DESCRIPTIONS

CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

> GITHUB SECURITY ADVISORY

GHSA-6ffj-2wg2-w45j HIGH

Apache Airflow allows code execution through crafted XCom payloads

AFFECTED PACKAGES:
PIP / apache-airflow-core
< 3.2.0
Fixed in: 3.2.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

AFFECTED PACKAGES:
Unknown / Unknown
8218 versions affected
ALIASES:
BIT-airflow-2026-25917, GHSA-6ffj-2wg2-w45j, PYSEC-2026-13, PYSEC-2026-2359

> HISTORIQUE DES MODIFICATIONS

Première apparition
18/04/2026 07:16
Source: NVD
📊 ENRICHISSEMENT 01/05/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Total des modifications: 1 Dernière mise à jour: 6 months ago

> REFERENCES

https://github.com/apache/airflow/pull/61641
https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po
http://www.openwall.com/lists/oss-security/2026/04/17/9
« BACK_TO_HOME