Deserialization in Apache Software Foundation Airflow
CVE-2026-59242
Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user w…
Vulnerability class: Insecure Deserialization
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Apache Software Foundation Airflow — versions 0
Weakness classification (CWE)
References
- security@apache.org (patch)
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-59242?
- CVE-2026-59242 is a medium-severity vulnerability in Apache Software Foundation Airflow, classified under Deserialization of Untrusted Data. CVSS score: 5.4/10. Published 2026-08-12.
- How severe is CVE-2026-59242?
- Medium severity. CVSS v3 base score is 5.4 out of 10.