CVE-2025-54550: Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag
Withdrawn Advisory This advisory has been withdrawn because it only affects example implementations, not Airflow releases on PyPI. This link is maintained to preserve external references.
Original Description The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.
It does not affect Airflow release - exampledags are not supposed to be enabled in production environment, however users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of the example with improved resiliance for that case.
Users who followed that pattern are advised to adjust their implementations accordingly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 3.2.0 - Configuration
Do not enable example_dags in production environments.
Apache Airflow example_dags = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54550?
CVE-2025-54550 is classified as a critical severity vulnerability that allows for remote code execution due to a race condition.
How do I fix CVE-2025-54550?
To fix CVE-2025-54550, upgrade Apache Airflow to a version greater than 3.2.0 to eliminate the vulnerable pattern in the example_xcom DAG.
What affected versions are vulnerable to CVE-2025-54550?
CVE-2025-54550 affects Apache Airflow versions up to and including 3.2.0.
What type of vulnerability is CVE-2025-54550?
CVE-2025-54550 is a remote code execution vulnerability caused by a race condition in the xcom feature.
Who is impacted by CVE-2025-54550?
Users of Apache Airflow who have access to modify XComs are at risk from CVE-2025-54550, enabling potential arbitrary code execution.