Apache Airflow allows code execution through unsafe serialized DAG deserialization
Summary
CVE-2026-33264: Apache Airflow allows code execution through unsafe serialized DAG deserialization. Affects apache-airflow versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-33264 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
A bug in BaseSerialization.deserialize() allowed unrestricted import_string() of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to apache-airflow 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the [core] allowed_deserialization_classes config to a narrow allowlist.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
