{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow-core","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.3.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-33264","cwes":["CWE-502"],"description":"A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.","epss":{"date":"2026-11-02","percentile":0.76494,"score":0.01649},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793688833359,"publishedAt":1783416018518,"references":[{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/66002"},{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/68528"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/07/07/1"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/66002"},{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/68528"}],"revision":"d27e998094e5cb258c3a31f8ea452e2111ac937e5fc7ce333b4ba3bf9ff75465","sources":[{"modifiedAt":1793688833359,"name":"CNA: apache","retrievedAt":1793689738978,"url":"https://www.cve.org/CVERecord?id=CVE-2026-33264"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793689759570,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33264"}],"ssvc":{"assessedAt":1783382400000,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()","updatedAt":1793689759570}