CVE-2026-33264 json
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
published 2026-07-07 4 mo ago modified 2026-11-03 6 d ago also BIT-airflow-2026-33264 , EUVD-2026-42030 , GHSA-2943-9672-r45w , PYSEC-2026-2082
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
Patch / fix
- pypi apache-airflow 3.3.0
- bitnami airflow 3.3.0
- Apache Software Foundation Apache Airflow 3.0.0, 3.3.0
- github.com/apache/airflow@69b6c54 commit
- github.com/apache/airflow@7e9bdb2 commit
- github.com/apache/airflow#66002 pull request
- github.com/apache/airflow#68528 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <3.3.0 |
3.3.0 |
| bitnami | airflow | <3.3.0 |
3.3.0 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/airflow/pull/66002
patch, web, issue-tracking
-
github.com
/apache/airflow/pull/68528
patch, web, issue-tracking
-
github.com
/apache/airflow/commit/69b6c54ef17b048ebb0e9a656d0d9e1c99480d6b
web
-
github.com
/apache/airflow/commit/7e9bdb245e09373d91fcb7bda575ad4be63aa28d
web
-
lists.apache.org
/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/07/07/1
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-33264
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2082.yaml
web
-
github.com
/advisories/GHSA-2943-9672-r45w
advisory
Sources
- CVE List CVE-2026-33264
- GitHub Advisory GHSA-2943-9672-r45w
- NVD CVE-2026-33264
- OSV BIT-airflow-2026-33264
- OSV PYSEC-2026-2082
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.