CVE-2026-33858: Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (type/var) Bypass in XCom API

April 13, 2026 (updated April 14, 2026)

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.

Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.

References

github.com/advisories/GHSA-mc4f-r875-v87w
github.com/apache/airflow
github.com/apache/airflow/pull/64148
lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0
nvd.nist.gov/vuln/detail/CVE-2026-33858

Code Behaviors & Features

Detect and mitigate CVE-2026-33858 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →