CVE-2026-42359: Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator
A bug in Apache Airflow's XCom PATCH endpoint PATCH /api/v2/xcomEntries/{key} allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g. returnvalue) that the matching POST endpoint already validated against FORBIDDENXCOMKEYS. The endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined, this allowed RCE on the triggerer when the affected task next deferred. Affects deployments where untrusted users have XCom write permission on Dags that defer to the triggerer. This is a fix-bypass of CVE-2026-33858: PR #64148 added the FORBIDDENXCOMKEYS validator only on the POST/set path; the PATCH path was not covered. Users who already upgraded for CVE-2026-33858 should additionally upgrade to apache-airflow 3.2.2 or later to cover the PATCH-path bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.2.2Patch CVE-2026-42359
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42359?
CVE-2026-42359 has a severity rating of 8.8, categorized as high risk.
How do I fix CVE-2026-42359?
The recommended fix for CVE-2026-42359 is to apply the available patch from Apache Airflow.
What type of vulnerability is CVE-2026-42359?
CVE-2026-42359 is an authenticated remote code execution (RCE) vulnerability.
Which versions of Apache Airflow are affected by CVE-2026-42359?
CVE-2026-42359 affects versions of Apache Airflow that include the vulnerable XCom PATCH endpoint.
What is the impact of CVE-2026-42359 on affected systems?
CVE-2026-42359 allows authenticated users to set XCom entries under reserved key names, potentially leading to unauthorized code execution.