Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-33264: Apache Airflow lets DAG authors run code on server
CVE-2026-33264 · published 4 months ago
Summary
Airflow can load a workflow definition (DAG) that contains a hidden command, letting the person who created the DAG execute code on the machine that runs the scheduler or API service. This bypasses the normal safety barrier that should keep user‑written code from running in those core processes. Upgrade Airflow to version 3.3.0 or newer, and if you limit who can create DAGs, configure a narrow allow‑list for deserialization classes to add extra protection.
What to do
- Update airflow to version 3.3.0.
- Update apache software foundation apache-airflow to version 3.3.0.
- Update apache-airflow to version 3.3.0.
- Update apache airflow to version 3.3.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache airflow |
< 3.3.0 < 3.0.0 |
| Bitnami | – | airflow |
< 3.3.0 Fix: upgrade to 3.3.0
|
| PyPI | apache software foundation | apache-airflow |
< 3.3.0 Fix: upgrade to 3.3.0
|
| – | apache | airflow |
< 3.3.0 cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* |
| pip | – | apache-airflow |
< 3.3.0 Fix: upgrade to 3.3.0
|
Original advisory text
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
References
- https://github.com/advisories/GHSA-2943-9672-r45w
- https://github.com/apache/airflow/commit/69b6c54ef17b048ebb0e9a656d0d9e1c99480d6...
- https://github.com/apache/airflow/commit/7e9bdb245e09373d91fcb7bda575ad4be63aa28...
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2...
- https://nvd.nist.gov/vuln/detail/CVE-2026-33264 Vendor Advisory
- https://pypi.python.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33264... Vendor Advisory
- https://github.com/apache/airflow/pull/66002 patch
- https://github.com/apache/airflow/pull/68528 patch
- https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/07/07/1 Mailing List Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published7 Jul 2026
Updated3 Nov 2026
First seen7 Jul 2026
Sources
CVE-2026-33264 · NVD
CVE-2026-33264 · OSV
CVE-2026-33264 · MITRE
BIT-airflow-2026-33264 · OSV
PYSEC-2026-2082 · OSV
GHSA-2943-9672-r45w · GHSA
Track software like this
Free during beta