Description

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T16:17:09.067Z",
  "pubdate": "2026-08-12T16:17:09.067Z",
  "executiveSummary": "An insecure deserialization vulnerability has been identified in Apache Airflow involving the XCom API endpoint. The vulnerability is classified under CWE-502, stemming from improper restriction of operations within the deserialization mechanism. The flaw impacts Apache Airflow instances running versions prior to 3.3.1. The risk implication of this vulnerability is severe, as successful exploitation enables authenticated threat actors to instantiate arbitrary airflow classes on the target API server. To successfully execute this attack, an authenticated user must possess specific capabilities, namely XCom write-and-read access, allowing them to supply a crafted string-literal payload and subsequently trigger its unsafe deserialization via the API endpoint. Remediation requires upgrading the affected software to the specified secure release version.",
  "technicalDetails": "The vulnerability resides within the Apache Airflow XCom subsystem, specifically exposed via the API endpoint GET /api/v2/{...}/xcomEntries/{key}?deserialize=true. The vulnerable component is the BaseXCom.deserialize_value function, which processes XCom values retrieved from storage. The root cause of the flaw is the absence of the _check_forbidden_xcom_keys guard when handling string-literal payloads passed directly through the deserialization routine. Consequently, input that should be strictly validated or restricted is processed without adequate security boundaries, permitting the instantiation of unauthorized internal objects. The affected versions include any deployment utilizing vulnerable codebase iterations prior to apache-airflow 3.3.1. Exploitation requires specific authentication and privilege requirements: the adversary must possess valid credentials and sufficient access controls to both write an arbitrary XCom value into the system and subsequently read it back with the deserialize=true query parameter enabled. The attack flow proceeds in a sequential manner. First, the authenticated attacker leverages their write permissions to inject a maliciously crafted string-literal payload into an XCom entry. Second, the attacker issues a GET request to the vulnerable xcomEntries endpoint with the deserialize parameter set to true. Third, the API server routes this request to the BaseXCom.deserialize_value function, which processes the malicious payload without executing the necessary reserved key checks or object instantiation restrictions. Fourth, the lack of validation results in the dynamic instantiation of arbitrary classes within the airflow.* namespace on the API server. The post-exploitation impact includes potential remote code execution, system manipulation, or further internal compromise depending on the capabilities of the instantiated classes and the privileges of the underlying application server."
}