CVE-2026-33264
apache-airflow: Deserialization of Untrusted Data (CVE-2026-33264)
criticalEPSS 1.7%
Affected
- pypi/apache-airflow
1.10.0..* - pypi/apache-airflow
1.10.1..* - pypi/apache-airflow
1.10.10..* - pypi/apache-airflow
1.10.10rc1..* - pypi/apache-airflow
1.10.10rc2..* - pypi/apache-airflow
1.10.10rc3..* - pypi/apache-airflow
1.10.10rc4..* - pypi/apache-airflow
1.10.10rc5..* - pypi/apache-airflow
1.10.11..* - pypi/apache-airflow
1.10.11rc1..* - pypi/apache-airflow
1.10.11rc2..* - pypi/apache-airflow
1.10.12..* - pypi/apache-airflow
1.10.12rc1..* - pypi/apache-airflow
1.10.12rc2..* - pypi/apache-airflow
1.10.12rc3..* - pypi/apache-airflow
1.10.12rc4..* - pypi/apache-airflow
1.10.13..* - pypi/apache-airflow
1.10.13rc1..* - pypi/apache-airflow
1.10.14..* - pypi/apache-airflow
1.10.14rc1..* - pypi/apache-airflow
1.10.14rc2..* - pypi/apache-airflow
1.10.14rc3..* - pypi/apache-airflow
1.10.14rc4..* - pypi/apache-airflow
1.10.15..* - pypi/apache-airflow
1.10.15rc1..* - pypi/apache-airflow
1.10.1b1..* - pypi/apache-airflow
1.10.1rc2..* - pypi/apache-airflow
1.10.2..* - pypi/apache-airflow
1.10.2b2..* - pypi/apache-airflow
1.10.2rc1..* - pypi/apache-airflow
1.10.2rc2..* - pypi/apache-airflow
1.10.2rc3..* - pypi/apache-airflow
1.10.3..* - pypi/apache-airflow
1.10.3b1..* - pypi/apache-airflow
1.10.3b2..* - pypi/apache-airflow
1.10.3rc1..* - pypi/apache-airflow
1.10.3rc2..* - pypi/apache-airflow
1.10.4..* - pypi/apache-airflow
1.10.4b2..* - pypi/apache-airflow
1.10.4rc1..* - pypi/apache-airflow
1.10.4rc2..* - pypi/apache-airflow
1.10.4rc3..* - pypi/apache-airflow
1.10.4rc4..* - pypi/apache-airflow
1.10.4rc5..* - pypi/apache-airflow
1.10.5..* - pypi/apache-airflow
1.10.5rc1..* - pypi/apache-airflow
1.10.6..* - pypi/apache-airflow
1.10.6rc1..* - pypi/apache-airflow
1.10.6rc2..* - pypi/apache-airflow
1.10.7..* - pypi/apache-airflow
1.10.7rc1..* - pypi/apache-airflow
1.10.7rc2..* - pypi/apache-airflow
1.10.7rc3..* - pypi/apache-airflow
1.10.8..* - pypi/apache-airflow
1.10.8rc1..* - pypi/apache-airflow
1.10.9..* - pypi/apache-airflow
1.10.9rc1..* - pypi/apache-airflow
1.8.1..* - pypi/apache-airflow
1.8.2..* - pypi/apache-airflow
1.8.2rc1..* - pypi/apache-airflow
1.9.0..* - pypi/apache-airflow
2.0.0..* - pypi/apache-airflow
2.0.0b1..* - pypi/apache-airflow
2.0.0b2..* - pypi/apache-airflow
2.0.0b3..* - pypi/apache-airflow
2.0.0rc1..* - pypi/apache-airflow
2.0.0rc2..* - pypi/apache-airflow
2.0.0rc3..* - pypi/apache-airflow
2.0.1..* - pypi/apache-airflow
2.0.1rc1..* - pypi/apache-airflow
2.0.1rc2..* - pypi/apache-airflow
2.0.2..* - pypi/apache-airflow
2.0.2rc1..* - pypi/apache-airflow
2.1.0..* - pypi/apache-airflow
2.1.0rc1..* - pypi/apache-airflow
2.1.0rc2..* - pypi/apache-airflow
2.1.1..* - pypi/apache-airflow
2.1.1rc1..* - pypi/apache-airflow
2.1.2..* - pypi/apache-airflow
2.1.2rc1..* - pypi/apache-airflow
2.1.3..* - pypi/apache-airflow
2.1.3rc1..* - pypi/apache-airflow
2.1.4..* - pypi/apache-airflow
2.1.4rc1..* - pypi/apache-airflow
2.1.4rc2..* - pypi/apache-airflow
2.10.0..* - pypi/apache-airflow
2.10.0b1..* - pypi/apache-airflow
2.10.0b2..* - pypi/apache-airflow
2.10.0rc1..* - pypi/apache-airflow
2.10.1..* - pypi/apache-airflow
2.10.1rc1..* - pypi/apache-airflow
2.10.2..* - pypi/apache-airflow
2.10.2rc1..* - pypi/apache-airflow
2.10.3..* - pypi/apache-airflow
2.10.3rc1..* - pypi/apache-airflow
2.10.3rc2..* - pypi/apache-airflow
2.10.4..* - pypi/apache-airflow
2.10.4rc1..* - pypi/apache-airflow
2.10.5..* - pypi/apache-airflow
2.10.5rc1..* - pypi/apache-airflow
2.11.0..* - pypi/apache-airflow
2.11.0rc1..* - pypi/apache-airflow
2.11.1..* - pypi/apache-airflow
2.11.1rc1..* - pypi/apache-airflow
2.11.1rc2..* - pypi/apache-airflow
2.11.2..* - pypi/apache-airflow
2.11.2rc1..* - pypi/apache-airflow
2.2.0..* - pypi/apache-airflow
2.2.0b1..* - pypi/apache-airflow
2.2.0b2..* - pypi/apache-airflow
2.2.0rc1..* - pypi/apache-airflow
2.2.1..* - pypi/apache-airflow
2.2.1rc1..* - pypi/apache-airflow
2.2.1rc2..* - pypi/apache-airflow
2.2.2..* - pypi/apache-airflow
2.2.2rc1..* - pypi/apache-airflow
2.2.2rc2..* - pypi/apache-airflow
2.2.3..* - pypi/apache-airflow
2.2.3rc1..* - pypi/apache-airflow
2.2.3rc2..* - pypi/apache-airflow
2.2.4..* - pypi/apache-airflow
2.2.4rc1..* - pypi/apache-airflow
2.2.5..* - pypi/apache-airflow
2.2.5rc1..* - pypi/apache-airflow
2.2.5rc2..* - pypi/apache-airflow
2.2.5rc3..* - pypi/apache-airflow
2.3.0..* - pypi/apache-airflow
2.3.0b1..* - pypi/apache-airflow
2.3.0rc1..* - pypi/apache-airflow
2.3.0rc2..* - pypi/apache-airflow
2.3.1..* - pypi/apache-airflow
2.3.1rc1..* - pypi/apache-airflow
2.3.2..* - pypi/apache-airflow
2.3.2rc1..* - pypi/apache-airflow
2.3.2rc2..* - pypi/apache-airflow
2.3.3..* - pypi/apache-airflow
2.3.3rc1..* - pypi/apache-airflow
2.3.3rc2..* - pypi/apache-airflow
2.3.3rc3..* - pypi/apache-airflow
2.3.4..* - pypi/apache-airflow
2.3.4rc1..* - pypi/apache-airflow
2.4.0..* - pypi/apache-airflow
2.4.0b1..* - pypi/apache-airflow
2.4.0rc1..* - pypi/apache-airflow
2.4.1..* - pypi/apache-airflow
2.4.1rc1..* - pypi/apache-airflow
2.4.2..* - pypi/apache-airflow
2.4.2rc1..* - pypi/apache-airflow
2.4.3..* - pypi/apache-airflow
2.4.3rc1..* - pypi/apache-airflow
2.5.0..* - pypi/apache-airflow
2.5.0rc1..* - pypi/apache-airflow
2.5.0rc2..* - pypi/apache-airflow
2.5.0rc3..* - pypi/apache-airflow
2.5.1..* - pypi/apache-airflow
2.5.1rc1..* - pypi/apache-airflow
2.5.1rc2..* - pypi/apache-airflow
2.5.2..* - pypi/apache-airflow
2.5.2rc1..* - pypi/apache-airflow
2.5.2rc2..* - pypi/apache-airflow
2.5.3..* - pypi/apache-airflow
2.5.3rc1..* - pypi/apache-airflow
2.5.3rc2..* - pypi/apache-airflow
2.6.0..* - pypi/apache-airflow
2.6.0b1..* - pypi/apache-airflow
2.6.0rc1..* - pypi/apache-airflow
2.6.0rc2..* - pypi/apache-airflow
2.6.0rc3..* - pypi/apache-airflow
2.6.0rc4..* - pypi/apache-airflow
2.6.0rc5..* - pypi/apache-airflow
2.6.1..* - pypi/apache-airflow
2.6.1rc1..* - pypi/apache-airflow
2.6.1rc2..* - pypi/apache-airflow
2.6.1rc3..* - pypi/apache-airflow
2.6.2..* - pypi/apache-airflow
2.6.2rc1..* - pypi/apache-airflow
2.6.2rc2..* - pypi/apache-airflow
2.6.3..* - pypi/apache-airflow
2.6.3rc1..* - pypi/apache-airflow
2.7.0..* - pypi/apache-airflow
2.7.0b1..* - pypi/apache-airflow
2.7.0rc1..* - pypi/apache-airflow
2.7.0rc2..* - pypi/apache-airflow
2.7.1..* - pypi/apache-airflow
2.7.1rc1..* - pypi/apache-airflow
2.7.1rc2..* - pypi/apache-airflow
2.7.2..* - pypi/apache-airflow
2.7.2rc1..* - pypi/apache-airflow
2.7.3..* - pypi/apache-airflow
2.7.3rc1..* - pypi/apache-airflow
2.8.0..* - pypi/apache-airflow
2.8.0b1..* - pypi/apache-airflow
2.8.0rc1..* - pypi/apache-airflow
2.8.0rc2..* - pypi/apache-airflow
2.8.0rc3..* - pypi/apache-airflow
2.8.0rc4..* - pypi/apache-airflow
2.8.1..* - pypi/apache-airflow
2.8.1rc1..* - pypi/apache-airflow
2.8.2..* - pypi/apache-airflow
2.8.2rc1..* - pypi/apache-airflow
2.8.2rc2..* - pypi/apache-airflow
2.8.2rc3..* - pypi/apache-airflow
2.8.3..* - pypi/apache-airflow
2.8.3rc1..* - pypi/apache-airflow
2.8.4..* - pypi/apache-airflow
2.8.4rc1..* - pypi/apache-airflow
2.9.0..* - pypi/apache-airflow
2.9.0b1..* - pypi/apache-airflow
2.9.0b2..* - pypi/apache-airflow
2.9.0rc1..* - pypi/apache-airflow
2.9.0rc2..* - pypi/apache-airflow
2.9.0rc3..* - pypi/apache-airflow
2.9.1..* - pypi/apache-airflow
2.9.1rc1..* - pypi/apache-airflow
2.9.1rc2..* - pypi/apache-airflow
2.9.2..* - pypi/apache-airflow
2.9.2rc1..* - pypi/apache-airflow
2.9.3..* - pypi/apache-airflow
2.9.3rc1..* - pypi/apache-airflow
3.0.0..* - pypi/apache-airflow
3.0.0b4..* - pypi/apache-airflow
3.0.0rc1..* - pypi/apache-airflow
3.0.0rc1.post1..* - pypi/apache-airflow
3.0.0rc1.post2..* - pypi/apache-airflow
3.0.0rc1.post3..* - pypi/apache-airflow
3.0.0rc1.post4..* - pypi/apache-airflow
3.0.0rc2..* - pypi/apache-airflow
3.0.0rc3..* - pypi/apache-airflow
3.0.0rc4..* - pypi/apache-airflow
3.0.1..* - pypi/apache-airflow
3.0.1rc1..* - pypi/apache-airflow
3.0.2..* - pypi/apache-airflow
3.0.2rc1..* - pypi/apache-airflow
3.0.2rc2..* - pypi/apache-airflow
3.0.3..* - pypi/apache-airflow
3.0.3rc1..* - pypi/apache-airflow
3.0.3rc2..* - pypi/apache-airflow
3.0.3rc3..* - pypi/apache-airflow
3.0.3rc4..* - pypi/apache-airflow
3.0.3rc5..* - pypi/apache-airflow
3.0.3rc6..* - pypi/apache-airflow
3.0.4..* - pypi/apache-airflow
3.0.4rc1..* - pypi/apache-airflow
3.0.4rc2..* - pypi/apache-airflow
3.0.5..* - pypi/apache-airflow
3.0.5rc1..* - pypi/apache-airflow
3.0.5rc2..* - pypi/apache-airflow
3.0.5rc3..* - pypi/apache-airflow
3.0.6..* - pypi/apache-airflow
3.0.6rc1..* - pypi/apache-airflow
3.0.6rc2..* - pypi/apache-airflow
3.1.0..* - pypi/apache-airflow
3.1.0b1..* - pypi/apache-airflow
3.1.0b2..* - pypi/apache-airflow
3.1.0rc1..* - pypi/apache-airflow
3.1.0rc2..* - pypi/apache-airflow
3.1.1..* - pypi/apache-airflow
3.1.1rc1..* - pypi/apache-airflow
3.1.1rc2..* - pypi/apache-airflow
3.1.2..* - pypi/apache-airflow
3.1.2rc1..* - pypi/apache-airflow
3.1.2rc2..* - pypi/apache-airflow
3.1.3..* - pypi/apache-airflow
3.1.3rc1..* - pypi/apache-airflow
3.1.4..* - pypi/apache-airflow
3.1.4rc1..* - pypi/apache-airflow
3.1.4rc2..* - pypi/apache-airflow
3.1.5..* - pypi/apache-airflow
3.1.5rc1..* - pypi/apache-airflow
3.1.6..* - pypi/apache-airflow
3.1.6rc1..* - pypi/apache-airflow
3.1.7..* - pypi/apache-airflow
3.1.7rc1..* - pypi/apache-airflow
3.1.7rc2..* - pypi/apache-airflow
3.1.8..* - pypi/apache-airflow
3.1.8rc1..* - pypi/apache-airflow
3.1.8rc2..* - pypi/apache-airflow
3.2.0..* - pypi/apache-airflow
3.2.0b1..* - pypi/apache-airflow
3.2.0b2..* - pypi/apache-airflow
3.2.0rc1..* - pypi/apache-airflow
3.2.0rc2..* - pypi/apache-airflow
3.2.1..* - pypi/apache-airflow
3.2.1rc1..* - pypi/apache-airflow
3.2.1rc2..* - pypi/apache-airflow
3.2.1rc3..* - pypi/apache-airflow
3.2.2..* - pypi/apache-airflow
3.2.2rc1..* - pypi/apache-airflow
3.2.2rc2..* - pypi/apache-airflow
3.2.2rc3..* - pypi/apache-airflow
3.3.0b1..* - pypi/apache-airflow
3.3.0b2..* - pypi/apache-airflow
3.3.0rc1..* - pypi/apache-airflow
3.3.0rc2..*
Description
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
pypiapache-airflow
1.10.01.10.11.10.101.10.10rc11.10.10rc21.10.10rc31.10.10rc41.10.10rc51.10.111.10.11rc11.10.11rc21.10.121.10.12rc11.10.12rc21.10.12rc31.10.12rc41.10.131.10.13rc11.10.141.10.14rc11.10.14rc21.10.14rc31.10.14rc41.10.151.10.15rc11.10.1b11.10.1rc21.10.21.10.2b21.10.2rc11.10.2rc21.10.2rc31.10.31.10.3b11.10.3b21.10.3rc11.10.3rc21.10.41.10.4b21.10.4rc11.10.4rc21.10.4rc31.10.4rc41.10.4rc51.10.51.10.5rc11.10.61.10.6rc1Metrics
Show all metrics
Severity
critical
116.72
no public PoC known
9.8
Published
2026-07-09 08:41 UTC
CWE-502
Weakness classes (CWE)
CWE-502Base
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
cwe.mitre.org →
References & sources
- http://www.openwall.com/lists/oss-security/2026/07/07/1advisory
- https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltjadvisory
- https://github.com/apache/airflow/pull/66002fix
- https://github.com/apache/airflow/pull/68528fix
- https://nvd.nist.gov/vuln/detail/CVE-2026-33264web
- https://github.com/apache/airflow/commit/69b6c54ef17b048ebb0e9a656d0d9e1c99480d6bweb
- https://github.com/apache/airflow/commit/7e9bdb245e09373d91fcb7bda575ad4be63aa28dweb
- https://github.com/apache/airflowpackage
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2082.yamlweb
- https://github.com/advisories/GHSA-2943-9672-r45wadvisory
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- CVE Modified2026-07-08 05:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
- SSVC: {"id":"CVE-2026-33264","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical… → {"id":"CVE-2026-33264","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
- New CVE Received2026-07-07 10:16 UTC· security@apache.org
- Affected: Apache Airflow
- Description: A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist.
- CWE: CWE-502
- Reference: https://github.com/apache/airflow/pull/66002