CVE-2026-59242: apache software foundation apache airflow Deserialization of Untrusted Data

Vulnerability summary

CVE-2026-59242 is a medium (CVSS 5.4) Deserialization of Untrusted Data vulnerability in apache software foundation apache airflow. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities.

Timeline

1. 12-08-2026
   PublishedVulnerability first disclosed.
2. 16-09-2026
   Last modifiedVulnerability information updated.

Description

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.