The vulnerability arises from an unsafe code pattern in the example_xcom included in Apache Airflow documentation, which reads values from XComs insecurely. This can be exploited by a UI user with modification rights on XComs to perform arbitrary code execution on the worker. The issue does not impact official Airflow releases since example DAGs are not meant for production. The documentation for Airflow 3.2.0 contains a safer example that addresses this problem. No official patch or remediation level has been published, and no known exploits exist in the wild.

The impact is limited to scenarios where a highly trusted UI user can modify XComs and has access to the vulnerable code pattern. This could lead to arbitrary code execution on the worker node. However, since the vulnerable example is not enabled in production and requires trusted user access, the overall risk is low. There are no known active exploits targeting this vulnerability.

Users should avoid using the unsafe example_xcom pattern from the documentation and instead follow the improved example provided in Airflow 3.2.0 documentation. Since this vulnerability stems from example code not intended for production, no official patch or fix is available or required. Users who have implemented similar patterns should review and adjust their code to prevent arbitrary code execution risks.