What this actually is.
Technical background, root cause, and affected surface.
The XCom PATCH endpoint (PATCH /api/v2/xcomEntries/{key}) in Apache Airflow 3.2.0-3.2.1 did not apply the FORBIDDEN_XCOM_KEYS validator already enforced on POST, and accepted serialized payload shapes the triggerer's deserializer treats as code. An authenticated user with XCom write permission could therefore achieve RCE on the triggerer when the affected task next deferred. This is a fix-bypass of CVE-2026-33858.
- Product
- Apache Airflow
- Vendor
- Apache
- Severity
- High
- CVSS Score
- 8.8
- Status
- Published
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-502: Deserialization of Untrusted Data
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
airflow API: PATCH /api/v2/xcomEntries/{key} - XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator (added only to POST/set path in PR #64148)
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Remote code execution on the Airflow triggerer
C:H · I:H · A:H
CWE-502: Deserialization of Untrusted Data
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade apache-airflow to 3.2.2 or later (PR #65915). Users already patched for CVE-2026-33858 must still upgrade.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor
Fixed release published (3.2.2)
Vendor advisory published
CVE published to MITRE
Disclosed 17 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.