Database/Control plane, storage & DevOps

Apache Airflow: XCom PATCH path bypasses the forbidden-key check and yields RCE on the triggerer

CVSS 8.8CVE-2026-42359Control plane, storage & DevOpscurated

Impact

The fix for CVE-2026-33858 added the FORBIDDEN_XCOM_KEYS validator only to the POST/set path, leaving PATCH uncovered. A user with XCom write permission on a DAG can therefore write reserved keys such as return_value, and supply serialized payload shapes that the triggerer's deserializer treats as code - giving code execution in the triggerer the next time an affected task defers. The triggerer is a long-lived shared process with access to connections and the metadata database, so this escalates a per-DAG permission into control over the orchestration layer that dispatches GPU jobs. Only deployments where untrusted users hold XCom write permission on deferring DAGs are affected.

Who can reach it

Authenticated UI or API user with XCom write permission on a DAG that defers to the triggerer. Network-reachable; no admin role needed.

What to do

Upgrade apache-airflow to 3.2.2 or later and restart the triggerer, scheduler and API server. Upgrading for CVE-2026-33858 alone is not sufficient - that fix left the PATCH path open. The cost is an orchestration restart window, not a node operation.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-42359 https://github.com/apache/airflow/pull/65915 https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s https://www.cve.org/CVERecord?id=CVE-2026-33858

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.