Vulnerability Description
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | < 3.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/apache/airflow/pull/61641Issue Tracking
- https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3poMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/17/9Mailing ListThird Party Advisory
FAQ
What is CVE-2026-25917?
CVE-2026-25917 is a vulnerability with a CVSS score of 7.2 (HIGH). Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru...
How severe is CVE-2026-25917?
CVE-2026-25917 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-25917?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.