Apache Airflow XComSetEntry Missing Reserved Key Validation Vulnerability

Vulnerability Overview This vulnerability concerns the reserved key check in the XCom update payload. Specifically, (POST ) rejects payloads containing reserved serialization keys (such as , , , , etc.) via a that recursively traverses values. However, (PATCH ) lacks this same validator, causing it to accept and store these reserved keys. Impact Scope This vulnerability affects users of Apache Airflow, particularly those updating XCom values via the endpoint. Attackers can leverage this vulnerability to inject malicious data, potentially leading to abnormal system behavior or security risks. Remediation The remediation steps include: 1. Extract the recursive traverser into a module-level helper function named . 2. Call this helper function in both and to ensure both endpoints apply the same reserved key checks. 3. Apply payload key checks from a single source. 4. Parameterize tests to mirror the existing , covering the PATCH path. 5. The regenerated files ( , , ) are pre-commit captures of unlinked descriptions that drifted into ; these do not constitute substantive changes. POC Code ```python Example of fixed code from airflow.models.xcom import XCom from pydantic import field_validator class XComCreateEntry(BaseModel): @field_validator('key', 'value', 'data', 'timestamp', 'execution_date', 'map_index', 'key', 'dag_id', 'run_id', 'task_id', 'session_id', 'update_id', 'source', 'source_type', 'source_version', 'source_environment', 'source_hostname', 'source_ip', 'source_port', 'source_protocol', 'source_user_agent', 'source_user_id', 'source_user_name', 'source_user_email', 'source_user_role', 'source_user_group', 'source_user_department', 'source_user_location', 'source_user_timezone', 'source_user_language', 'source_user_country', 'source_user_region', 'source_user_city', 'source_user_zipcode', 'source_user_phone', 'source_user_fax', 'source_user_mobile', 'source_user_pager', 'source_user_other', 'source_user_other_value', 'source_user_other_label', 'source_user_other_description', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_other_url', 'source_user_other_image', 'source_user_other_video', 'source_user_other_audio', 'source_user_other_document', 'source_user_other_file', 'source_user_other_folder', 'source_user_other_directory', 'source_user_other_path', 'source_user_oth

Goal Reached Thanks to every supporter — we hit 100%!

Apache Airflow XComSetEntry Missing Reserved Key Validation Vulnerability

More from this source