This vulnerability allows a malicious DAG author to embed a malicious payload in an XCom value, exploiting the legacy deserialization handling that interprets the __type and __var keys. The result is that the Airflow webserver executes the untrusted code embedded in the payload. The primary impact is remote code execution within the webserver process, which, while requiring DAG author privileges, enables an attacker to run arbitrary commands on the host.

Apache Airflow, all versions prior to the 3.2.0 release are affected. The vendor has released version 3.2.0 to fully resolve the issue; no specific sub‑versions are listed in the advisory.

The flaw carries a CVSS base score of 8.8, indicating a high severity level. No EPSS data or KEV catalog listing is available, yet the vulnerability remains actionable in any installation where users can assume the DAG author role. Exploitation requires the creation and submission of a specially crafted XCom payload via the Airflow XCom API, which the webserver deserializes without adequate validation. The exploitation path is inferred; the attack vector involves a privileged DAG author leveraging the XCom API to trigger code execution.