Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom
    payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted,
    severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the
    issue. (CVE-2026-25917)

The version of Apache Airflow installed on the remote host is prior to 3.2.0. It is, therefore, affected by multiple vulnerabilities, including:

  - DAG authors who normally should not be able to execute code in the webserver context can craft     an XCom payload causing the webserver to execute arbitrary code via deserialization.
    (CVE-2026-25917)

  - An example of BashOperator in the Airflow documentation suggested passing dag_run.conf in a way     that could cause unsanitized user input to be used to escalate privileges of a UI user and     execute code on a worker. (CVE-2026-30898)

  - A UI or API user with asset materialize permission could trigger DAGs they had no access to.
    This issue affects Apache Airflow 3.0.0 through 3.1.x. (CVE-2026-32228)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460565	Echo: apache-airflow-core: security update to 3.2.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
460565	Echo: apache-airflow-core: security update to 3.2.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
315213	Apache Airflow < 3.2.0 Multiple Vulnerabilities	Nessus	Misc.	Local	high
440713	SCA: security update for apache-airflow-core (GHSA-6ffj-2wg2-w45j)	Tenable Cloud Security	SCA Checks	Local	high
440713	SCA: security update for apache-airflow-core (GHSA-6ffj-2wg2-w45j)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-25917

high

Tenable Plugins

high

high

high

high

high