CVE-2026-25917

high

Published 2026-04-18 · Modified 2026-05-20

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2

—

VIR risk

8.0

Description

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	apache-airflow-core	`<3.2.0`	`3.2.0`
PyPI	apache-airflow	`<3.2.0`	`3.2.0`
PIP	apache-airflow-core	`< 3.2.0`	`3.2.0`

References

https://nvd.nist.gov/vuln/detail/CVE-2026-25917
https://github.com/apache/airflow/pull/61641
https://github.com/apache/airflow
https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po
http://www.openwall.com/lists/oss-security/2026/04/17/9
https://github.com/advisories/GHSA-6ffj-2wg2-w45j

Verify integrity in audit chain (admin only). AS-IS.