PyPI/apache-airflow CVE-2026-59242: medium 5.4, EPSS 0.53%

Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Action: Upgrade apache-airflow to 3.3.1 or later.

pip install apache-airflow==3.3.1

Affected

Fixed versions

Sources

• osv: GHSA-fcmm-42r9-mmmm
• https://nvd.nist.gov/vuln/detail/CVE-2026-59242
• https://github.com/apache/airflow/pull/69378
• https://github.com/apache/airflow/commit/78abd3044654d44d711eb61e475029fd1b1ccc23
• https://github.com/apache/airflow/commit/d08ddc0127d5be7f9b31c1f935bc4d25a897a848
• https://github.com/apache/airflow
• https://github.com/apache/airflow/releases/tag/3.3.1
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-3992.yaml
• https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg
• http://www.openwall.com/lists/oss-security/2026/08/12/6

CVE-2026-59242 · published 2026-08-12T18:31:18Z · modified 2026-10-02T23:40:42.734966774Z · JSON