What is the CVSS score of CVE-2026-42359?

CVE-2026-42359 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache Airflow are affected by CVE-2026-42359?

Apache Airflow versions 3.2.0 through 3.2.1 contain a remote code execution vulnerability in the XCom update endpoint that allows authenticated users with update permissions to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-42359?

Within 24 hours: Audit all Airflow deployments to identify versions 3.2.0-3.2.1 and review accounts with XCom update permissions. Within 7 days: Upgrade to the latest patched Apache Airflow release. Within 30 days: Verify successful deployment and enforce least-privilege access to XCom update functionality.

Apache Airflow CVE-2026-42359

EUVD-2026-33588 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-31

GHSA-wr76-29cr-67w8

Apache Deserialization Airflow

8.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 14:22 vuln.today

Analysis Generated

Jun 02, 2026 - 14:22 vuln.today

CVSS changed

Jun 02, 2026 - 14:22 NVD

8.8 (HIGH)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

May 31, 2026 - 12:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 31, 2026 - 12:45 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 pypi packages depend on apache-airflow (1 direct, 9 indirect)

Ecosystem-wide dependent count for version 3.2.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Authenticated remote code execution in Apache Airflow 3.2.0 through 3.2.1 allows users with permission to update XCom entries to achieve code execution by submitting reserved deserialization metadata keys (e.g. __classname__, __type, __data__, __var) to the PATCH XCom endpoint. The XComUpdateBody datamodel omitted the FORBIDDEN_XCOM_KEYS validator that XComCreateBody enforced, letting attackers smuggle a malicious typed payload that is later deserialized into an arbitrary Python class. No public exploit identified at time of analysis and EPSS risk is negligible (0.02%), but a vendor fix has shipped and the root cause is a classic CWE-502 untrusted deserialization.

Technical ContextAI

Apache Airflow's REST API exposes XCom (cross-communication) entries used to pass data between task instances. Airflow serializes complex Python objects into XCom using metadata keys such as __classname__, __type, __var, and __data__, and on read it reconstructs the original object via its serialization framework. The fix in PR apache/airflow#65915 factors the recursive _check_forbidden_xcom_keys helper out of XComCreateBody and adds an equivalent @field_validator to XComUpdateBody so that PATCH requests are also walked recursively and rejected (HTTP 422) when any forbidden key is present at any nesting depth. The root cause is CWE-502 Deserialization of Untrusted Data: the create-path was hardened, but the update-path was not, leaving a gap where attacker-controlled type metadata reached the deserializer and could instantiate arbitrary registered classes such as airflow.sdk.definitions.connection.Connection or other gadgets.

RemediationAI

Vendor-released patch: upgrade Apache Airflow to 3.2.2 or later, which adds the FORBIDDEN_XCOM_KEYS field validator to XComUpdateBody as shown in apache/airflow PR #65915 (https://github.com/apache/airflow/pull/65915); consult the ASF advisory at https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s. If immediate upgrade is not possible, restrict who holds the 'can_edit' permission on XCom resources in Airflow's RBAC so that only highly-trusted operators can call the PATCH /dags/{dag_id}/dagRuns/{run_id}/taskInstances/{task_id}/xcomEntries/{key} endpoint, and block access to that route at a reverse proxy or WAF for any non-admin principals - the trade-off is that legitimate workflows that update XCom via the REST API will break. Network-isolating the Airflow webserver/API behind authenticated VPN or SSO further reduces exposure but does not address the authenticated-attacker threat model. Audit existing XCom entries for unexpected __classname__, __type, __var, or __data__ keys to detect prior tampering.