A bug in the XCom PATCH endpoint PATCH /api/v2/xcomEntries/{key} allows an authenticated UI/API user with XCom write permission on a DAG to set XCom entries under reserved key names such as return_value that are normally blocked when created via the POST endpoint. Because the PATCH endpoint does not enforce the FORBIDDEN_XCOM_KEYS validator, the attacker can inject a payload that the triggerer deserializes as code. When the affected task next defers to the triggerer, the serialized payload is executed, giving the attacker remote code execution on the worker that runs the triggerer.

Apache Airflow deployments where untrusted or externally delegated users are granted XCom write permissions on DAGs that later defer to the triggerer. The vulnerability exists in all versions before apache‑airflow 3.2.2; users who previously applied the fix for CVE‑2026‑33858 must also upgrade to 3.2.2 or later to cover the PATCH‑path bypass.

The exploit requires the attacker to be an authenticated UI/API user with XCom write access, so the scope is limited to authorized accounts. However, once the malicious XCom entry is stored, any task that defers to the triggerer will deserialize the payload and execute arbitrary code, leading to full compromise of the Airflow worker host. The CVSS score of 8.8 indicates high severity. The EPSS score is < 1%, and the vulnerability is not listed in the KEV catalog, but the potential impact is high due to the remote code execution capability. The lack of a validated REST endpoint path makes detection difficult, so monitoring of PATCH operations and XCom key usage is advised.