CVE-2026-86829
2026-11-09
09h52 +00:00
09h52 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than Deployment Managers are affected, and the scheduler must be evaluating a task dependency that reads a task-written XCom value. Users of apache-airflow are recommended to upgrade to version 3.4.0 or later, which restricts dependency evaluation to primitive XCom values.CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Deserialization of Untrusted Data The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
