EUVD-2026-57315
GHSA-8prw-8m6x-8w6f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
DAG-author access (PR:L) is the sole prerequisite; Scheduler processes the payload automatically over the network path, with full C/I/A impact on credential-holding components.
Primary rating from Vendor (apache).
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionNVD
Apache Airflow's serialization layer reconstructed exception nodes by calling import_string() on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executor_config reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example subprocess.check_output, or builtins.eval on the builtins-prefixed variant. The code runs in the Scheduler, which reconstructs serialized Dags in its normal loop with no request involved, and in the API server, on any authenticated read of the Dag such as GET /api/v2/dags/{dag_id}/details. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a different sink from CVE-2026-33264, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of BaseException.
Articles & Coverage 2
AnalysisAI
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution in the Scheduler and API server by placing a crafted value in an operator's executor_config field. The serialization layer reconstructed exception nodes by calling import_string() on an attacker-controlled class name with no allowlist, enabling import and invocation of arbitrary callables such as subprocess.check_output or builtins.eval. Both affected components hold the metadata database credentials and JWT signing secret, making full infrastructure compromise a realistic outcome. No public exploit has been identified at time of analysis, but no non-default configuration is required. This is a distinct sink from CVE-2026-33264, meaning deployments that already patched that earlier advisory remain fully vulnerable and must upgrade again to apache-airflow 3.3.1.
Technical ContextAI
Apache Airflow uses a serialization layer (airflow/serialization/serialized_objects.py) to persist and reconstruct DAG objects, including exception nodes encoded as BASE_EXC_SER blobs. Prior to the fix, the deserializer called import_string() - a dynamic module importer - on a class name taken verbatim from the serialized blob, then instantiated it with attacker-supplied arguments. CWE-502 (Deserialization of Untrusted Data) is the root cause: the application trusted the type information embedded in the serialized payload without validation. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:* covering versions 3.0.0 to below 3.3.1. The executor_config field on operators flows through this deserialization path, which is exercised both by the Scheduler during its normal DAG reconstruction loop and by the API server on authenticated GET /api/v2/dags/{dag_id}/details requests. Both components operate outside the Airflow security model's intended trust boundary for DAG-author code, yet both reached the vulnerable branch unconditionally.
RemediationAI
Upgrade to apache-airflow 3.3.1 or later, which replaces the unconstrained import_string() call in the exception deserialization path with a restricted resolver (_resolve_airflow_exception) that only allows classes already present in sys.modules that are confirmed subclasses of AirflowException, and limits builtin exception reconstruction to a hardcoded allowlist of KeyError and AttributeError. The upstream fix is available in GitHub PR https://github.com/apache/airflow/pull/68511. The vendor advisory is at https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos. If immediate upgrade is not possible, the most effective compensating control is to restrict DAG author access to only fully trusted personnel, since the exploit requires the ability to deploy a DAG containing a crafted executor_config. Disabling the REST API endpoint GET /api/v2/dags/{dag_id}/details eliminates one trigger path but does not protect the Scheduler, which exercises the vulnerable code path automatically and continuously. Network-level ACLs on the Scheduler or API server are ineffective because the vulnerability is triggered by already-persisted DAG content, not by inbound network requests at exploitation time.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
Unsafe XCom templating in Apache Airflow's documented example DAG (`example_xcom.py`) allowed an authenticated UI user w
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today