Skip to content

CVE record · 1 source

CVE-2026-86829

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.

Vendor: Apache Software Foundation
Product: Apache Airflow
Weakness: CWE-502
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

CVE NVD 2h ago

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the…

Fix available CVE-2026-86829 Apache Software Foundation