BIT-airflow-2026-42359
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2026-42359.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/BIT-airflow-2026-42359
- Aliases
- Published
- 2026-06-05T05:40:40Z
- Modified
- 2026-09-08T08:45:38Z
- Summary
- Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator
- Details
-
A bug in Apache Airflow's XCom PATCH endpoint
PATCH /api/v2/xcomEntries/{key}allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g.return_value) that the matching POST endpoint already validated againstFORBIDDEN_XCOM_KEYS. The endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined, this allowed RCE on the triggerer when the affected task next deferred. Affects deployments where untrusted users have XCom write permission on Dags that defer to the triggerer. This is a fix-bypass of CVE-2026-33858: PR #64148 added theFORBIDDEN_XCOM_KEYSvalidator only on the POST/set path; the PATCH path was not covered. Users who already upgraded for CVE-2026-33858 should additionally upgrade toapache-airflow3.2.2 or later to cover the PATCH-path bypass. - Database specific
{ "cpes": [ "cpe:2.3:a:apache:airflow:*:*:*:*:*:python:*:*" ], "severity": "High" }- References
Affected packages
Bitnami / airflow
Package
- Name
- airflow
- Purl
- pkg:bitnami/airflow
Severity
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator