EUVD-2026-57315
GHSA-8prw-8m6x-8w6f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
DAG-author access (PR:L) is the sole prerequisite; Scheduler processes the payload automatically over the network path, with full C/I/A impact on credential-holding components.
Primary rating from Vendor (apache).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Apache Airflow's serialization layer reconstructed exception nodes by calling import_string() on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executor_config reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example subprocess.check_output, or builtins.eval on the builtins-prefixed variant. The code runs in the Scheduler, which reconstructs serialized Dags in its normal loop with no request involved, and in the API server, on any authenticated read of the Dag such as GET /api/v2/dags/{dag_id}/details. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a different sink from CVE-2026-33264, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of BaseException.
Articles & Coverage 2
AnalysisAI
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution in the Scheduler and API server by placing a crafted value in an operator's executor_config field. The serialization layer reconstructed exception nodes by calling import_string() on an attacker-controlled class name with no allowlist, enabling import and invocation of arbitrary callables such as subprocess.check_output or builtins.eval. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold DAG-author access - specifically the ability to write to the DAG directory or submit a DAG containing a crafted executor_config on any operator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the threat: network-reachable, low complexity, requiring only DAG-author-level access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with DAG-author access crafts an operator whose executor_config encodes a BASE_EXC_SER blob naming subprocess.check_output as the exception class and a shell command as its arguments. Once the DAG is committed to the DAG folder or uploaded via the API, the Scheduler reconstructs it in its normal processing loop, triggering import and execution of subprocess.check_output with the attacker's arguments - granting arbitrary OS command execution under the Scheduler's service account, which has access to database credentials and the JWT signing secret. … |
| Remediation | Upgrade to apache-airflow 3.3.1 or later, which replaces the unconstrained import_string() call in the exception deserialization path with a restricted resolver (_resolve_airflow_exception) that only allows classes already present in sys.modules that are confirmed subclasses of AirflowException, and limits builtin exception reconstruction to a hardcoded allowlist of KeyError and AttributeError. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Airflow deployments running versions 3.0.0-3.3.0 and immediately begin upgrades to Apache Airflow 3.3.1 (note: this is a distinct vulnerability from CVE-2026-33264; organizations that patched that prior advisory remain fully vulnerable). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today