CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
A bug in BaseSerialization.deserialize() allowed unrestricted importstring() of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to apache-airflow 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the [core] alloweddeserializationclasses config to a narrow allowlist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.3.0Patch CVE-2026-33264 - Configuration
As a defense-in-depth mitigation for limited DAG-author trust, restrict [core] allowed_deserialization_classes to a narrow allowlist so attacker-controlled import_string class paths are not deserialized by BaseSerialization.deserialize().
Apache Airflow [core] allowed_deserialization_classes = narrow allowlist
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33264?
CVE-2026-33264 has a risk rating of 30, indicating a high severity level.
How do I fix CVE-2026-33264?
To fix CVE-2026-33264, ensure you update Apache Airflow to the latest version that addresses this vulnerability.
What does CVE-2026-33264 affect?
CVE-2026-33264 affects Apache Airflow, specifically the feature related to DAG authoring and serialization.
What is the vulnerability in CVE-2026-33264?
CVE-2026-33264 allows remote code execution via unrestricted import_string() in the BaseSerialization.deserialize() method.
Who is impacted by CVE-2026-33264?
Developers and organizations using Apache Airflow are impacted by CVE-2026-33264 if they allow DAG authors to submit untrusted code.