CVE-2026-33264
CriticalA bug in BaseSerialization.deserialize() allowed unrestricted import_string() of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server /…
Published Jul 7, 2026 · Updated Sep 10, 2026 · Also known as BIT-airflow-2026-33264, EUVD-2026-42030, GHSA-2943-9672-r45w, PYSEC-2026-2082
Key Facts
Patch in the next maintenance window- CVE-2026-33264 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Airflow (Apache), airflow-3 (minimos), Apache Airflow (pypi).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including Airflow 3.3.0, airflow-3 3.3.0-r0, Apache Airflow 3.3.0.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
1.6%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-33264 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A bug in BaseSerialization.deserialize() allowed unrestricted import_string() of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to apache-airflow 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the [core] allowed_deserialization_classes config to a narrow allowlist.
Affected Products
6 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| AirflowApache | See advisory | 3.3.0 |
| airflow-3minimos | See advisory | 3.3.0-r0 |
| Apache Airflowpypi | See advisory | 3.3.0 |
Patched Releases
Airflow
3.3.0
airflow-3
3.3.0-r0
Apache Airflow
3.3.0
Timeline
Publicly disclosed
Jul 7, 2026
Last updated
Sep 10, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisoryGHSA advisory
- advisoryhttps://github.com/apache/airflow/commit/69b6c54ef17b048ebb0e9a656d0d9e1c99480d6b
- advisoryhttps://github.com/apache/airflow/commit/7e9bdb245e09373d91fcb7bda575ad4be63aa28d
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33264.json
- advisoryhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2082.yaml
FAQ
Common Questions.
A bug in BaseSerialization.deserialize() allowed unrestricted import_string() of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow sec…
Affected: Airflow (Apache); airflow-3 (minimos); Apache Airflow (pypi). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Airflow 3.3.0, airflow-3 3.3.0-r0, Apache Airflow 3.3.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-33264 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo