CVE-2026-86829

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than…

9. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-86829