CVE-2026-42359General(apache / airflow)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache airflow systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g. `return_value`) that the matching POST endpoint already validated against `FORBIDDEN_XCOM_KEYS`. The endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined, this allowed RCE on the triggerer when the affected task next deferred. Affects deployments where untrusted users have XCom write permission on Dags that defer to the triggerer. This is a fix-bypass of CVE-2026-33858: PR #64148 added the `FORBIDDEN_XCOM_KEYS` validator only on the POST/set path; the PATCH path was not covered. Users who already upgraded for CVE-2026-33858 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the PATCH-path bypass.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/apache/airflow/pull/65915

Vendor / third-party advisories

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

airflow

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-05-31); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

apache

Products

airflow

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42359

Classification over time

Date	Total	Labels

2026-05-31	1	General1
2026-06-01	1	Patch1

Full discourse2 posts

Upwind Security MDR@UpwindMDR136d
Patch
🚨 Critical - Apache Airflow Deserialization RCE (CVE-2026-42359) Authenticated users with XCom write permission can exploit a deserialization flaw in the XCom PATCH API endpoint. This allows setting reserved keys (e.g. return_value), leading to remote code execution on the triggerer when deferred tasks run. This is a bypass of the previous fix for CVE-2026-33858. 👉Affected: Apache Airflow 3.2.0 , Fixed: 3.2.2+
Post summary
Apache Airflow 3.2.0 is vulnerable to a deserialization-based remote code execution flaw (CVE-2026-42359) via the XCom PATCH API; the issue is addressed in version 3.2.2 and later.
0000080
197 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-42359 CVE-2026-42359 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42359
Post summary
The text merely repeats the CVE identifier and links to a vulnerability details page, providing no substantive information about the vulnerability itself.
0000049
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	airflow	-	-	-

Explore more

Back to dashboard apache CVEs airflow vulnerabilities