# CVE-2026-59242: Apache Airflow XCom deserialization arbitrary class instantiation

Source: https://junglewise.ai/threats/cve-2026-59242-apache-airflow-xcom-deserialization-arbitrary-class-instantiation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59242 · Severity: medium · CVSS 5.4 · Published 2026-08-12

Apache Airflow's XCom API endpoint allows authenticated users to store and retrieve cross-component task data. A vulnerability in the deserialization process allows an authenticated user with write-and-read access to cause the server to instantiate arbitrary Airflow classes, potentially leading to remote code execution or unauthorized data access. The flaw bypasses security checks by encoding malicious payloads as JSON string literals.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow), [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-59242 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59242 being exploited in the wild.

**How severe is CVE-2026-59242?** Medium severity, with a CVSS score of 5.4, published 12 August 2026.

**Which products and versions are affected?** Apache Airflow before 3.3.1; apache-airflow (PyPI) < 3.3.1, ECOSYSTEM:introduced=0,fixed=3.3.1.

**Is there a fix for CVE-2026-59242?** Yes. apache-airflow (PyPI): upgrade to 3.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59242 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-59242?** Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-airflow (PyPI): upgrade to 3.3.1 or later

  ```sh
  pip install "apache-airflow>=3.3.1"
  ```


## Technical details

The vulnerability is an unsafe deserialization issue (CWE-502) in the GET `/api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint. The `BaseXCom.deserialize_value` function processes XCom values without applying the `_check_forbidden_xcom_keys` guard when payloads are submitted as JSON string literals. The guard's validation logic only traverses dict, list, and tuple structures but does not inspect string values, allowing an attacker to submit a JSON-encoded malicious object as a string. When the endpoint deserializes with `?deserialize=true`, the string is parsed back into a dict containing reserved keys like `__classname__`, triggering arbitrary class instantiation. Exploitation requires an authenticated API user with both write and read permissions on XCom. Apache Airflow 3.3.1 and later reject reserved serialization keys even when submitted as JSON string literals, mitigating the issue.

## Affected products

- Apache Airflow before 3.3.1

## Identifiers

- CVE-2026-59242
- BIT-AIRFLOW-2026-59242
- GHSA-fcmm-42r9-mmmm
- PYSEC-2026-3992

## Timeline

- 2026-08-12: disclosed
- 2026-07-06: patched: Fix merged in PR #69378

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/69378](https://github.com/apache/airflow/pull/69378)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)