CVE-2026-33264
published 2026-07-07CVE-2026-33264: A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.65%
74.0th percentile
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 3.3.0 | 3.3.0 |
| apache_software_foundation | apache_airflow | < 3.3.0 | 3.3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Airflow up to 3.2.x Trigger BaseSerialization.deserialize deserialization (WID-SEC-2026-2223)
vuldb·2026-07-08·CVSS 9.8
CVE-2026-33264 [CRITICAL] Apache Airflow up to 3.2.x Trigger BaseSerialization.deserialize deserialization (WID-SEC-2026-2223)
A vulnerability was found in Apache Airflow up to 3.2.x. It has been rated as critical. This vulnerability affects the function BaseSerialization.deserialize of the component Trigger Handler. This manipulation causes deserialization.
This vulnerability is handled as CVE-2026-33264. The attack can be initiated remotely. There is not any exploit available.
GHSA
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a
ghsa_unreviewed·2026-07-07
CVE-2026-33264 [CRITICAL] CWE-502 A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-07
Published