CVE-2026-59242: Apache Airflow XCom RCE Vulnerability

CVE-2026-59242 Overview

CVE-2026-59242 is an insecure deserialization vulnerability [CWE-502] in Apache Airflow's XCom API. The GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint passes a string-literal payload through BaseXCom.deserialize_value without applying the _check_forbidden_xcom_keys guard. An authenticated API user with XCom write-and-read access can instantiate arbitrary airflow.* classes on the API server. Exploitation requires the attacker to first write an XCom value and then read it back with deserialize=true. Apache has released apache-airflow 3.3.1, which rejects reserved XCom serialization keys submitted as JSON string literals.

Critical Impact
Authenticated users with XCom read and write permissions can instantiate arbitrary airflow.* classes on the API server, bypassing the intended deserialization allow-list.

Affected Products

Apache Airflow versions prior to 3.3.1
Deployments exposing the XCom REST API endpoint GET /api/v2/{...}/xcomEntries/{key}
Any Airflow environment where API users hold XCom write-and-read permissions

Discovery Timeline

2026-08-12 - CVE-2026-59242 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-59242

Vulnerability Analysis

Apache Airflow uses XCom (cross-communication) to pass small payloads between tasks. The REST API endpoint GET /api/v2/{...}/xcomEntries/{key}?deserialize=true retrieves a stored XCom value and optionally deserializes it before returning it to the caller. Airflow's BaseXCom.deserialize_value supports reconstructing arbitrary airflow.* classes when the payload carries specific reserved keys.

A _check_forbidden_xcom_keys guard normally blocks user-supplied payloads from reaching that class-instantiation path. The affected endpoint bypasses this guard when the XCom value is stored as a JSON string literal, so the deserializer processes attacker-controlled input directly.

Root Cause

The root cause is missing enforcement of _check_forbidden_xcom_keys on string-literal XCom payloads before they are handed to BaseXCom.deserialize_value. The deserializer trusts the payload to contain safe content and proceeds to instantiate any referenced airflow.* class. This is a classic unsafe deserialization pattern [CWE-502], where the code path assumes the input has been validated but the validation was applied only to dictionary-shaped payloads.

Attack Vector

The attacker must hold a valid API session with permission to write and read XCom entries. The attacker writes a crafted XCom value containing a reserved serialization key as a JSON string literal. They then issue a GET request to xcomEntries/{key}?deserialize=true. The API server deserializes the payload and instantiates the attacker-specified airflow.* class. Exploitation is limited to classes reachable from the airflow.* namespace on the server, which bounds the impact but still enables abuse of internal Airflow objects.

For technical details, see the GitHub Airflow Pull Request and the Apache Mailing List Thread.

Detection Methods for CVE-2026-59242

Indicators of Compromise

API requests to xcomEntries/{key} endpoints with the deserialize=true query parameter from unexpected user accounts.
XCom entries whose stored value is a JSON string literal referencing reserved serialization keys or airflow.* class paths.
Unusual instantiation of airflow.* classes on the API server correlated with authenticated XCom write activity.

Detection Strategies

Enable Airflow API audit logging and alert on paired write-then-read XCom sequences performed by the same principal within short time windows.
Inspect Airflow API access logs for GET requests containing deserialize=true and correlate with preceding POST/PUT XCom writes from the same user.
Baseline normal XCom payload shapes per DAG and flag payloads containing reserved key names or class-path strings.

Monitoring Recommendations

Forward Airflow webserver and API logs into a centralized log platform for correlation with authentication events.
Monitor process activity on Airflow API server hosts for unexpected child processes or module loads originating from the webserver process.
Track version inventory of apache-airflow packages across all environments to identify hosts still running vulnerable releases.

How to Mitigate CVE-2026-59242

Immediate Actions Required

Upgrade apache-airflow to version 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.
Review and reduce the set of API users granted XCom write-and-read permissions to the minimum required.
Rotate API tokens and credentials for any account suspected of unauthorized XCom activity.

Patch Information

Apache Airflow 3.3.1 contains the fix. The patch extends _check_forbidden_xcom_keys enforcement to string-literal payloads flowing through BaseXCom.deserialize_value, so the deserializer no longer instantiates airflow.* classes from attacker-controlled input. Refer to the GitHub Airflow Pull Request and the Openwall OSS Security Update for release details.

Workarounds

Restrict access to the Airflow REST API using network controls so only trusted clients can reach xcomEntries endpoints.
Avoid calling XCom retrieval endpoints with deserialize=true from untrusted clients until the upgrade is applied.
Apply role-based access control to strip XCom write permissions from any principal that does not require them.

bash

# Upgrade Apache Airflow to the patched release
pip install --upgrade "apache-airflow>=3.3.1"

# Verify installed version
airflow version