# CVE-2026-86829: Apache Airflow scheduler XCom deserialization privilege escalation

Source: https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-86829 · Severity: info · Published 2026-11-09

Apache Airflow is a workflow orchestration platform where DAG authors write tasks but have less privilege than deployment managers. The scheduler was deserializing all data written by task code when evaluating dependencies, allowing a DAG author to execute arbitrary code in the scheduler process—a privileged context they should not access. This affects deployments that treat DAG authors as less trusted than deployment managers.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-86829 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86829 being exploited in the wild.

**How severe is CVE-2026-86829?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Airflow before 3.4.0.

**Is there a fix for CVE-2026-86829?** Yes: fixed in 3.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86829 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86829?** Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.4.0

## Technical details

The scheduler deserializes XCom (task communication) values written by task code while evaluating task dependencies via TaskInstance.xcom_pull → XComModel.deserialize_value, which uses json.loads with XComDecoder.object_hook to fully reconstruct serialized objects. A DAG author controlling task XCom writes can craft a serialized object with __classname__ to trigger instantiation of arbitrary classes during scheduler dependency evaluation. The fix restricts dependency evaluation to primitive JSON values only, reading XCom without object reconstruction at the four dependency evaluation call sites.

## Affected products

- Apache Airflow before 3.4.0

## Timeline

- 2026-11-09: disclosed
- 2026-10-19: patched: PR #72718 merged to main branch

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/72718](https://github.com/apache/airflow/pull/72718)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)
- [Apache Airflow CeleryExecutor callback code execution](https://junglewise.ai/threats/cve-2026-68982-apache-airflow-s-celeryexecutor-ran-callback-workloads)