CVE-2026-33264— Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
Quick assessment
Affected
Apache Software Foundation Apache Airflow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Software Foundation Apache Airflow是Apache Software Foundation基金会的开源工作流调度与数据管道编排平台。 Apache Airflow 3.3.0之前版本存在反序列化注入漏洞，该漏洞源于BaseSerialization.deserialize()在Scheduler/API Server加载序列化DAG时，允许无限制地import_string()攻击者控制的类路径，导致DAG作者可嵌入恶意触发实现远程代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | < 3.3.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33264
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
Source: CVE Program / CVE List V5
Vulnerability Description
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Airflow 反序列化注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Software Foundation Apache Airflow是Apache Software Foundation基金会的开源工作流调度与数据管道编排平台。 Apache Airflow 3.3.0之前版本存在反序列化注入漏洞，该漏洞源于BaseSerialization.deserialize()在Scheduler/API Server加载序列化DAG时，允许无限制地import_string()攻击者控制的类路径，导致DAG作者可嵌入恶意触发实现远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 ~ 3.3.0 | - |
|
II. Public POCs for CVE-2026-33264
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33264
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-33264 (1)
Mailing List Discussions for CVE-2026-33264 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-07 · 6 CVEs total
| CVE-2026-49487 | Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs | |
| CVE-2026-48828 | Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called wit | |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagS | |
| CVE-2026-48891 | Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via tri | |
| CVE-2026-48892 | Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthet |
IV. Related Vulnerabilities
Same product: Apache Airflow
-
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A -
CVE-2026-75157
Apache Airflow: Asset queued-events DELETE endpoints gated o -
CVE-2026-59244
Apache Airflow: Secrets masker: `var.json` Variable values n
Same vendor: Apache Software Foundation
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious do -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
Same weakness: CWE-502
-
CVE-2026-103877
Apache Directory LDAP API: Unsafe loading of Java code from -
CVE-2026-55083
DHIS2: Unsafe Java Deserialization - Remote Code Execution ( -
CVE-2026-12544
Foreman: ssti and insecure deserialization in foreman-rake c -
CVE-2026-97284
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vu -
CVE-2026-94390
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5
V. Comments for CVE-2026-33264
No comments yet