CVE-2025-54550
Severity CVSS v4.0:
Pending analysis
Type:
CWE-94
Code Injection
Publication date:
15/04/2026
Last modified:
17/04/2026
Description
The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value<br />
from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary<br />
execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.<br />
<br />
It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however<br />
users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of<br />
the example with improved resiliance for that case.<br />
<br />
Users who followed that pattern are advised to adjust their implementations accordingly.
Impact
Base Score 3.x
8.10
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* | 3.2.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page