CVE-2026-33264 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-33264 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-33264 is a critical deserialization vulnerability in Apache Airflow's BaseSerialization.deserialize() function that allows a malicious DAG author to trigger unrestricted class loading via attacker-controlled import paths on the Scheduler and API Server.

Technical Detail

The flaw exists in BaseSerialization.deserialize(), which calls import_string() on class path values embedded in serialized DAG definitions without adequate validation or allowlisting. An attacker with DAG authoring access can craft a serialized DAG containing an arbitrary class path, which the Scheduler or API Server will resolve and instantiate upon loading. Successful exploitation results in remote code execution in the context of the Airflow Scheduler or API Server process, which typically operates with broad access to pipeline infrastructure, credentials, and connected data systems.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog as of July 14, 2026. Despite the absence of public exploit code, the vulnerability class is well understood and the attack surface is accessible to any user with DAG write permissions, which lowers the practical barrier to exploitation once technical details become more widely available.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE as of the date of this briefing.

What To Do

Apply the vendor-supplied patch from Apache Airflow as a priority given the CVSS score of 9.8 and the direct path to remote code execution. Organizations should treat this as an urgent patch given that the attack surface is reachable by any user with DAG authoring privileges, a role that may be broadly granted in multi-tenant or shared Airflow deployments. As an interim control, restrict DAG authoring access to trusted users only and audit existing DAG submissions for unexpected or external class references in serialized content. Monitor Scheduler and API Server process activity for anomalous child process spawning, unexpected network connections, or unusual file system writes, which may indicate exploitation attempts. Review Airflow role-based access controls and enforce the principle of least privilege for DAG submission permissions until patching is complete.