CVE-2026-33264: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-33264 is a critical deserialization vulnerability in Apache Airflow's BaseSerialization.deserialize() function that allows DAG authors to achieve remote code execution on the Airflow Scheduler and API Server processes. The flaw affects all versions of apache-airflow before 3.3.0 and was publicly disclosed on July 7, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). When the Scheduler or API Server loads a serialized DAG, BaseSerialization.deserialize() called import_string() on attacker-controlled class paths embedded in the DAG's trigger fields (specifically trigger_kwargs and next_kwargs within StartTriggerArgs) without any validation or allowlist enforcement. A DAG author could embed a malicious trigger into a DAG file, causing the Scheduler or API Server to import and instantiate an arbitrary Python class upon DAG deserialization — crossing Airflow's fundamental security boundary that DAG-author code must never execute in those privileged processes. The fix (PR #66002) stops deserialization of trigger_kwargs in the Scheduler/API Server path, keeping them as raw JSON, and PR #68528 removed the dead DAT.BASE_TRIGGER serialization path entirely (GitHub PR #66002, GitHub PR #68528).

Successful exploitation grants an attacker arbitrary code execution with the privileges of the Airflow Scheduler and API Server service accounts, resulting in full compromise of confidentiality, integrity, and availability of those processes. An attacker with DAG authoring access could exfiltrate sensitive data (e.g., connection credentials, variables, XCom data), tamper with workflow orchestration, disrupt pipeline availability, and potentially pivot to other systems accessible by the Scheduler or API Server. This effectively allows privilege escalation from a DAG author role to system-level access on the Airflow control plane (GitHub Advisory, Feedly).

1. Gain DAG authoring access: Obtain credentials or permissions to submit or modify DAG files in the target Apache Airflow deployment (e.g., via a compromised developer account, misconfigured DAG repository, or insider access).
2. Craft a malicious DAG: Create a DAG file that embeds a malicious trigger with attacker-controlled class paths in the trigger_kwargs or next_kwargs fields of a StartTriggerArgs object, referencing an arbitrary Python class (e.g., a class that executes OS commands upon instantiation).
3. Submit the DAG: Upload or push the malicious DAG to the Airflow DAG folder or connected repository so it is picked up by the Scheduler or API Server.
4. Trigger deserialization: When the Scheduler or API Server loads and deserializes the DAG, BaseSerialization.deserialize() calls import_string() on the attacker-controlled class path, importing and instantiating the malicious class in the Scheduler/API Server process.
5. Achieve RCE: The instantiated malicious class executes arbitrary code with the privileges of the Scheduler/API Server service account, enabling reverse shell establishment, credential theft, or further lateral movement (GitHub PR #66002, GitHub Advisory).

• Logs: Unexpected Python import errors or tracebacks in Airflow Scheduler or API Server logs referencing unusual class paths; log entries showing import_string() calls to non-standard or external namespaces during DAG deserialization.
• Process: Unusual child processes spawned by the Airflow Scheduler or API Server (e.g., bash, sh, python, curl, wget, nc) that are not part of normal task execution.
• File System: New or modified files in the DAG directory containing unusual trigger definitions with embedded class path strings pointing to non-Airflow modules; unexpected scripts or binaries written to disk by the Scheduler/API Server process.
• Network: Unexpected outbound network connections from the Scheduler or API Server host to external IPs or domains not associated with configured Airflow connections or operators.

Upgrade to apache-airflow version 3.3.0 or later, which contains the complete fix via PR #66002 (stopping deserialization of trigger_kwargs in Scheduler/API Server) and PR #68528 (removing the dead DAT.BASE_TRIGGER path) (GitHub PR #66002, GitHub PR #68528). As a defense-in-depth workaround for deployments where DAG-author trust is limited and immediate upgrade is not possible, restrict the [core] allowed_deserialization_classes configuration option to a narrow allowlist of trusted classes (GitHub Advisory). Additionally, enforce strict access controls on who can author or submit DAGs to limit the attack surface.

The Apache Software Foundation published the security advisory on July 7, 2026, and the fix was tracked under the Airflow 3.3.0 milestone (Apache Advisory). The vulnerability was also disclosed via the oss-security mailing list and noted in the NixOS nixpkgs security tracker, prompting a package update. Community discussion on Mastodon (infosec.exchange) and Bluesky noted the critical severity and the security boundary violation as particularly significant for multi-tenant Airflow deployments.