# CVE-2026-25917: Apache Airflow remote code execution via crafted XCom payloads

Source: https://junglewise.ai/threats/cve-2026-25917-apache-airflow-remote-code-execution-via-crafted-xcom-payloads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-18. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-25917 · Severity: high · CVSS 7.2 · Published 2026-04-18

Apache Airflow, a platform used to schedule and monitor workflows, is vulnerable to a security flaw that allows authorized workflow authors to execute malicious code on the central webserver. While these authors are typically trusted users, this vulnerability allows them to bypass intended security boundaries and potentially compromise the entire Airflow environment. Organizations should upgrade to version 3.2.0 to prevent unauthorized system access.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow), [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow), [apache-airflow-core (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow-core). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-25917 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25917 being exploited in the wild.

**How severe is CVE-2026-25917?** High severity, with a CVSS score of 7.2, published 18 April 2026.

**Which products and versions are affected?** apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0; apache-airflow-core (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

**Is there a fix for CVE-2026-25917?** Yes. apache-airflow (PyPI): upgrade to 3.2.0 or later; apache-airflow-core (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25917 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25917?** Check whether you run Apache Airflow, apache-airflow (PyPI) or apache-airflow-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-airflow (PyPI): upgrade to 3.2.0 or later

  ```sh
  pip install "apache-airflow>=3.2.0"
  ```

- apache-airflow-core (PyPI): upgrade to 3.2.0 or later

  ```sh
  pip install "apache-airflow-core>=3.2.0"
  ```


## Technical details

A deserialization vulnerability (CWE-502) exists in Apache Airflow's handling of XCom payloads within the API extra-links component. The root cause is the use of full deserialization/class instantiation when processing XCom values for the "details" page of a task, rather than safe stringification. An attacker with DAG author privileges (High privileges) can craft a malicious XCom payload that, when processed by the webserver, triggers arbitrary code execution. The issue is resolved in Apache Airflow 3.2.0 by implementing safe string conversion for XCom values in the extra links API.

## Affected products

- Apache apache-airflow-core < 3.2.0

## Identifiers

- CVE-2026-25917
- GHSA-6ffj-2wg2-w45j
- PYSEC-2026-13
- PYSEC-2026-2359

## Timeline

- 2026-02-09: patched: Fix merged into main branch via PR 61641
- 2026-04-17: disclosed: Mailing list announcement on oss-security
- 2026-04-18: advisory: GitHub Advisory and NVD entry published

## References

- [https://github.com/apache/airflow/pull/61641](https://github.com/apache/airflow/pull/61641)
- [https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po](https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po)
- [http://www.openwall.com/lists/oss-security/2026/04/17/9](http://www.openwall.com/lists/oss-security/2026/04/17/9)
- [https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-13.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-13.yaml)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)