Apache Airflow 3.2.0 contains a deserialization vulnerability (CWE-502) in the XCom PATCH endpoint (`PATCH /api/v2/xcomEntries/{key}`) that allows authenticated users with XCom write permissions to set XCom entries using reserved keys such as `return_value`. The POST endpoint already validated against these forbidden keys, but the PATCH endpoint did not, allowing a bypass of the prior fix for CVE-2026-33858. The endpoint accepts serialized payloads that the triggerer's deserializer treats as executable code, enabling remote code execution on the triggerer when the affected task defers. This vulnerability impacts deployments where untrusted users have XCom write permissions on DAGs that defer to the triggerer. The issue is fixed in Apache Airflow 3.2.2 and later.

An authenticated user with XCom write permission can bypass key validation to inject serialized payloads that lead to remote code execution on the triggerer process. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is a fix bypass of a previous vulnerability (CVE-2026-33858) and affects Apache Airflow 3.2.0. Exploitation requires authenticated access with specific permissions.

Users should upgrade Apache Airflow to version 3.2.2 or later to address this vulnerability. The vendor advisory indicates that the PATCH endpoint lacked the forbidden key validation present in the POST endpoint, which was fixed in 3.2.2. There is no indication that temporary mitigations or workarounds exist. Patch status is not explicitly stated but the advisory strongly recommends upgrading to 3.2.2 or later for full remediation.