Vulnerability Description
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | >= 3.1.8, < 3.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/apache/airflow/pull/64148Issue Tracking
- https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/13/7Mailing ListThird Party Advisory
FAQ
What is CVE-2026-33858?
CVE-2026-33858 is a vulnerability with a CVSS score of 8.8 (HIGH). Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru...
How severe is CVE-2026-33858?
CVE-2026-33858 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33858?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.