IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-04-13 15:17

MODIFIED

2026-04-13 15:17

EPSS (Prob. Exploit)

1.06%

Top 35.7%

DATA SOURCES:

NVD 🔗 2026-04-13 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25

> DESCRIPTION

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-502

> CWE DETAILED DESCRIPTIONS

CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/04/2026 15:17

Source: NVD

📊 ENRICHISSEMENT 01/05/2026 06:01

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Total des modifications: 1 Dernière mise à jour: 6 months ago

> REFERENCES

https://github.com/apache/airflow/pull/64148

https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0