What’s Vulnerable › Vulnerabilities

CVE-2023-50943: Apache Airflow: Potential pickle deserialization vulnerability in XComs

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-24 · updated 2026-06-17
• Weakness: CWE-502

Description

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.

Affected products

• Apache Airflow: before 2.8.1 — fixed in 2.8.1

How to fix

Upgrade to a fixed version: Apache Airflow 2.8.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/01/24/4
• https://github.com/apache/airflow/pull/36255
• https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn
• http://www.openwall.com/lists/oss-security/2024/01/24/4
• https://github.com/apache/airflow/pull/36255
• https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn

Get alerted when CVE-2023-50943 or the next vulnerability affects your stack