Threats tagged 'ghsa-3w6w-wrj8-46xr'

Apache Airflow's Task Execution API allowed tasks to store XCom values without enforcing the reserved-key check, enabling a DAG author to write XComs that could cause the API server to instantiate classes from the airflow namespace with attacker-controlled arguments when deserialized. This vulnerability is a partial bypass of the fix for CVE-2026-59242, affecting users who applied the fix in version 3.3.1. Users should upgrade to version 3.4.0 or later to fully remediate the issue.