CVE-2026-42359

A bug in Apache Airflow's XCom PATCH endpoint "PATCH /api/v2/xcomEntries/key" allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names e.g. "returnvalue" that the matching POST endpoint already validated against "FORBIDDENXCOMKEYS". The...

CVE-2026-42359: Deserialization of Untrusted Data

A bug in Apache Airflow's XCom PATCH endpoint PATCH /api/v2/xcomEntries/key allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names e.g. returnvalue that the matching POST endpoint already validated against FORBIDDENXCOMKEYS. The...