Home / Vulnerability Intelligence / CVE-2025-54550

CVE-2025-54550 - Vulnerability Analysis

HighCVSS: 8.1

Last Updated: April 17, 2026

Apache Airflow - Remote Code Execution

Published: April 15, 2026Updated: April 17, 2026Remote Exploitable

Overview

Apache Airflow example_xcom in example_dags contains a code execution vulnerability caused by unsafe reading of XCom values, letting trusted UI users execute arbitrary code on workers, exploit requires UI access to modify XComs.

Severity & Score

Severity: High

CVSS Score: 8.1

Impact

Trusted UI users can execute arbitrary code on worker nodes, potentially compromising the system.

Mitigation

Update to Airflow 3.2.0 or later with improved example_xcom implementation.

References

https://github.com/apache/airflow/pull/63200
https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1
http://www.openwall.com/lists/oss-security/2026/04/15/1

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2025-54550
Severity: High
CVSS Score: 8.1
Type: undefined
Status: confirmed

CWE

CWE-94

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N