CVE-2026-33264
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG. A DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary.
Risk Assessment
The risk is that a user with DAG authoring privileges can achieve remote code execution on the Scheduler or API Server, potentially leading to full compromise of the Airflow environment and access to sensitive data.
Recommendation
Upgrade to Apache Airflow version 3.3.0 or later immediately. As a defense-in-depth measure, in deployments with limited DAG-author trust, restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
Original NVD description (English source)
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.