CVE-2026-42359: Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Synopsis

An authenticated remote code execution vulnerability affects Apache Airflow versions 3.2.0 through 3.2.1 in the XCom PATCH endpoint (PATCH /api/v2/xcomEntries/{key}). Any authenticated user with XCom write permission on a DAG can bypass the reserved-key validation that was added only to the POST path, inject a serialized payload under a reserved key name such as return_value, and trigger deserialization-based code execution on the triggerer process when the affected task next defers. Successful exploitation gives the attacker full code execution on the Airflow triggerer. A patched-image rebuild at version 3.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Airflow API or UI over the network; the vulnerable endpoint is exposed via the standard HTTP API surface.

• AuthenticationRequired

  A valid account with XCom write permission on at least one DAG is required; any low-privilege user granted that permission is sufficient.

• Victim interactionNot required

  No user interaction is needed; the attacker submits the malicious XCom entry directly and exploitation occurs automatically when the affected task next defers.

• Attack complexityDetail

  Attack complexity is low: the exploit is reliable and requires no race conditions, memory-layout knowledge, or other environmental preconditions beyond having XCom write permission.

Blast Radius

• The attacker executes arbitrary code on the Airflow triggerer process, gaining full control of that component.
• Secrets accessible to the triggerer, including DAG connection credentials and environment variables, are exposed to the attacker.
• The attacker can modify or delete persisted DAG state, XCom entries, and task metadata stored in the Airflow metadata database via the triggerer's database access.
• The triggerer process can be crashed or made to crash repeatedly, disrupting deferred task execution across all DAGs that rely on it.