{"action":"Upgrade apache-airflow to 3.2.2 or later.","affected":[{"fixed":"3.2.2","introduced":"3.2.0"}],"component":"apache-airflow","cve_ids":["CVE-2026-42359"],"ecosystem":"PyPI","epss":0.00571,"exploited":false,"fixed_versions":["3.2.2"],"ghsa_id":"GHSA-wr76-29cr-67w8","id":"tcs_01M5KGW20M556YZJ3WNXXAT37K","modified_at":"2026-07-13T16:45:06.377267047Z","published_at":"2026-06-01T09:16:18.907Z","references":["https://osv.dev/vulnerability/PYSEC-2026-185","https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s","https://www.cve.org/CVERecord?id=CVE-2026-33858","https://github.com/apache/airflow/pull/65915","https://github.com/advisories/GHSA-wr76-29cr-67w8"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-185","url":"https://osv.dev/vulnerability/PYSEC-2026-185"}],"summary":"A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e"}