CVE-2026-33858: Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.
Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33858?
CVE-2026-33858 has been classified with a high severity due to the possibility of arbitrary code execution in the webserver context.
How do I fix CVE-2026-33858?
To mitigate CVE-2026-33858, users should upgrade to Apache Airflow version 3.2.0 or later to ensure legacy serialization keys are properly handled.
Who is affected by CVE-2026-33858?
CVE-2026-33858 affects Apache Airflow versions between 3.1.8 and 3.2.0, allowing Dag Authors to exploit unsafe deserialization.
What are the consequences of CVE-2026-33858?
The consequence of CVE-2026-33858 is that it allows unauthorized code execution through manipulated XCom payloads, potentially compromising the webserver.
What is the impact of unsafe deserialization in CVE-2026-33858?
The impact of unsafe deserialization in CVE-2026-33858 can lead to remote code execution, allowing attackers to run arbitrary code on the server.