Echo: apache-airflow: security update to 3.2.2

high Tenable Cloud Security Plugin ID 458643

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated
UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g.
`return_value`) that the matching POST endpoint already validated against `FORBIDDEN_XCOM_KEYS`. The
endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined,
this allowed RCE on the triggerer when the affected task next deferred. Affects deployments where
untrusted users have XCom write permission on Dags that defer to the triggerer. This is a fix-bypass of
CVE-2026-33858: PR #64148 added the `FORBIDDEN_XCOM_KEYS` validator only on the POST/set path; the PATCH
path was not covered. Users who already upgraded for CVE-2026-33858 should additionally upgrade to
`apache-airflow` 3.2.2 or later to cover the PATCH-path bypass. (CVE-2026-42359)

Solution

Update the apache-airflow library and its related packages to version 3.2.2 or later.

Plugin Details

Severity: High

ID: 458643

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.95

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-42359

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/11/2026

Vulnerability Publication Date: 6/1/2026

Reference Information

CVE: CVE-2026-42359

Detections

Analytics