CVE-2026-33264
published 2026-07-07CVE-2026-33264: A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.65%
76.3th percentile
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 3.3.0 | 3.3.0 |
| apache | airflow | >= 3.3.0 < 3.3.1 | 3.3.1 |
| apache_software_foundation | apache_airflow | >= 3.0.0 < 3.3.1 | 3.3.1 |
| apache_software_foundation | apache_airflow | >= 3.3.0 < 3.3.1 | 3.3.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, w
ghsa_unreviewed·2026-08-12·CVSS 9.8
CVE-2026-58076 [CRITICAL] CWE-502 Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, w
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/details`. Both are components the Airflow security model states must never execute Dag
GHSA
Apache Airflow exception-node deserialization permits arbitrary callable execution
ghsa·2026-08-12·CVSS 9.8
CVE-2026-58076 [CRITICAL] CWE-502 Apache Airflow exception-node deserialization permits arbitrary callable execution
Apache Airflow exception-node deserialization permits arbitrary callable execution
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/de
VulDB
Apache Airflow up to 3.2.x Trigger BaseSerialization.deserialize deserialization (WID-SEC-2026-2223)
vuldb·2026-07-08·CVSS 9.8
CVE-2026-33264 [CRITICAL] Apache Airflow up to 3.2.x Trigger BaseSerialization.deserialize deserialization (WID-SEC-2026-2223)
A vulnerability was found in Apache Airflow up to 3.2.x. It has been rated as critical. This vulnerability affects the function BaseSerialization.deserialize of the component Trigger Handler. This manipulation causes deserialization.
This vulnerability is handled as CVE-2026-33264. The attack can be initiated remotely. There is not any exploit available.
GHSA
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a
ghsa_unreviewed·2026-07-07
CVE-2026-33264 [CRITICAL] CWE-502 A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
GHSA
Apache Airflow allows code execution through unsafe serialized DAG deserialization
ghsa·2026-07-07
CVE-2026-33264 [CRITICAL] CWE-502 Apache Airflow allows code execution through unsafe serialized DAG deserialization
Apache Airflow allows code execution through unsafe serialized DAG deserialization
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-07
Published