https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:03:23.587288+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2026-59242 BIT-airflow-2026-59242 — Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint 2026-10-04T01:03:23.662089+00:00

Affected: Bitnami: airflow

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

 https://cve.radiocsirt.org/vuln/euvd-2026-369568 EUVD-2026-369568 2026-10-04T01:03:23.662151+00:00 EUVD-2026-369568 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59242 fkie_cve-2026-59242 2026-10-04T01:03:23.662168+00:00

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

 https://cve.radiocsirt.org/vuln/ghsa-fcmm-42r9-mmmm GHSA-fcmm-42r9-mmmm — Apache Airflow XCom API permits unsafe deserialization through JSON string literals 2026-10-04T01:03:23.662195+00:00

Affected: PyPI: apache-airflow

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

 https://cve.radiocsirt.org/vuln/pysec-2026-3992 PYSEC-2026-3992 2026-10-04T01:03:23.662220+00:00

Affected: PyPI: apache-airflow

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2823 WID-SEC-W-2026-2823 — Apache Airflow: Mehrere Schwachstellen 2026-10-04T01:03:23.662241+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.