The flaw resides in the Airflow XCom API route GET /api/v2/{…}/xcomEntries/{key}?deserialize=true, which passes string‑literal payloads directly to BaseXCom.deserialize_value without validation. This missing guard allows an authenticated user who can write and read XComs to instantiate any class prefixed with airflow.* on the server. The vulnerability is a classic insecure deserialization problem (CWE‑502) that can lead to arbitrary code execution on the API server.

Affected systems are installations of Apache Airflow provided by the Apache Software Foundation. Versions prior to 3.3.1 are vulnerable because the fix was introduced in 3.3.1, which rejects reserved XCom serialization keys supplied as JSON string literals. Therefore any Airflow deployment running an earlier 3.x version must be upgraded. The impact applies only to environments where users have XCom write and read permissions.

The CVSS score is 5.4, classifying the issue as medium severity. The EPSS score is not available, and it is not listed in CISA KEV, suggesting limited known exploitation but still a non‑negligible risk. Exploitation requires an authenticated API session with XCom read/write privileges, so internal users or attackers with token access can trigger the vulnerable endpoint. The lack of a public exploit does not mitigate the risk because the condition is relatively easy to satisfy in many enterprise deployments.