CVE-2026-33264: Apache Airflow allows code execution through unsafe serialized DAG deserialization
(updated )
A bug in BaseSerialization.deserialize() allowed unrestricted import_string() of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to apache-airflow 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the [core] allowed_deserialization_classes config to a narrow allowlist.
References
- github.com/advisories/GHSA-2943-9672-r45w
- github.com/apache/airflow/commit/69b6c54ef17b048ebb0e9a656d0d9e1c99480d6b
- github.com/apache/airflow/commit/7e9bdb245e09373d91fcb7bda575ad4be63aa28d
- github.com/apache/airflow/pull/66002
- github.com/apache/airflow/pull/68528
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2082.yaml
- lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj
- nvd.nist.gov/vuln/detail/CVE-2026-33264
Code Behaviors & Features
Detect and mitigate CVE-2026-33264 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →