CVE-2026-42359

A bug in Apache Airflow 's XCom PATCH endpoint (PATCH /api/v2/xcomEntries/{key}) allows an authenticated UI/API user with XCom write permissions to set entries under reserved keys, such as return_value. Because this endpoint lacks the FORBIDDEN_XCOM_KEYS validator present in the POST path, it acc...