XCom Value Exposure in Apache Airflow's Task Execution API by Apache
CVE-2026-111421

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Airflow
Vendor: CVE Published:; 9 November 2026

What is CVE-2026-111421?

The Task Execution API in Apache Airflow is susceptible to a vulnerability where stored XCom values can be manipulated without proper key checks. This flaw allows a Dag author's task to write custom XCom data, which, when accessed through the API with deserialization enabled, can result in unauthorized instantiation of classes from the 'airflow.*' namespace. Users who previously addressed an earlier related vulnerability in apache-airflow 3.3.1 should upgrade to version 3.4.0 or later to mitigate potential risks associated with this exposure.