EUVD-2026-42030
GHSA-2943-9672-r45w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker must have DAG-author privileges (PR:L) rather than none; code path is low-complexity; S:C because DAG-author code escapes its zone to execute in the separately-trusted Scheduler/API Server, with full C/I/A.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionCVE.org
A bug in BaseSerialization.deserialize() allowed unrestricted import_string() of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to apache-airflow 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the [core] allowed_deserialization_classes config to a narrow allowlist.
Articles & Coverage 1
AnalysisAI
Remote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controlled class path is loaded via an unrestricted import_string() when the Scheduler or API Server deserializes the serialized DAG, executing arbitrary code in those privileged processes and breaking the core Airflow boundary that DAG-author code must never run in the Scheduler/API Server. Reported by Apache with a fix in 3.3.0, it currently has no public exploit identified and a low EPSS of 0.69% (48th percentile), and it is not listed in CISA KEV. The practical severity depends heavily on how much a deployment trusts its DAG authors, since exploitation requires the ability to submit a DAG.
Technical ContextAI
The root cause is CWE-502 (Deserialization of Untrusted Data): BaseSerialization.deserialize() invoked Python's import_string() on class paths taken directly from serialized trigger kwargs without any allowlist, so an attacker-chosen dotted class path would be imported and instantiated. In Airflow, deferred tasks persist trigger_kwargs and next_kwargs that are later read back; the vulnerable code path (deserialize_kwargs calling BaseSerialization.deserialize on stored trigger_kwargs/next_kwargs in serialized_objects.py) ran inside the Scheduler and API Server processes rather than only in the isolated worker/triggerer context. The upstream fix (PRs 66002 and 68528) stops eagerly deserializing those stored kwargs - passing the raw var values through instead - and normalizes Encoding enum keys via a new stringify_encoding_keys() helper so the encrypted blob round-trips without re-invoking the dangerous deserializer, effectively removing the untrusted import_string() call from the privileged load path.
RemediationAI
Vendor-released patch: upgrade apache-airflow to 3.3.0 or later, which removes the eager BaseSerialization.deserialize() of stored trigger/next kwargs in the Scheduler and API Server (upstream fixes in https://github.com/apache/airflow/pull/66002 and https://github.com/apache/airflow/pull/68528; see the advisory at https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj). Where immediate upgrade is not possible and DAG-author trust is limited, apply the vendor's defense-in-depth mitigation by setting [core] allowed_deserialization_classes to a narrow allowlist of only the classes your DAGs legitimately deserialize, which blocks import of arbitrary attacker class paths - with the trade-off that an over-tight allowlist can break legitimate triggers/operators and requires inventorying the classes your deployment actually uses. Additionally restrict who can author or submit DAGs (git-sync source control, review gates, and limited API/DAG write access) to shrink the attacker population until the upgrade is completed.
More in Apache Airflow
View allUnsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today