CVE-2026-33264 is a critical security vulnerability in Apache Airflow, the workflow orchestration platform many organizations use to automate data pipelines, analytics, cloud operations, and business processes. If your organization operates Airflow versions earlier than 3.3.0, this issue could allow a malicious or insufficiently trusted workflow author to execute code within core Airflow services.
The business concern is not simply that a workflow can fail. A successful compromise could give an attacker access to sensitive data flows, automation credentials, cloud-connected systems, and production workloads that depend on Airflow scheduling. Organizations in the United States and Canada should treat this as a priority where Airflow supports regulated data, customer-facing services, financial reporting, healthcare operations, or critical internal automation.
This post explains the vulnerability in business terms, outlines practical exposure scenarios, helps you determine whether you may be affected, and provides technical guidance for security and operations teams.
Apache Airflow disclosed CVE-2026-33264 on July 7, 2026. The issue affects Apache Airflow versions earlier than 3.3.0 and involves the way the platform processes certain serialized workflow definitions, known as directed acyclic graphs or DAGs. Apache identified the issue as an unsafe handling of untrusted serialized data, which can allow code supplied through a workflow definition to run in privileged Airflow services.
The advisory credits Ziyu Lin, intadd, and K as finders, with bugbunny.ai identified as the supporting tool. Apache developers Amogh Desai and Jarek Potiuk are credited for remediation work.lists.apache
CISA’s Authorized Data Publisher assessment assigns CVE-2026-33264 a Critical 9.8 out of 10 score under the Common Vulnerability Scoring System. The NVD lists the weakness as CWE-502, Deserialization of Untrusted Data. Apache’s remediation is available in apache-airflow version 3.3.0 and later.
If you use a vulnerable Airflow deployment, this issue can undermine a key security assumption: that the people who create data workflows do not automatically receive the same level of system access as the services that run them. In a successful attack, a malicious workflow author could move from submitting workflow content to running code in Airflow’s scheduler or application programming interface server processes.
For your operations, that can mean disrupted pipelines, failed reporting, delayed data deliveries, or manipulation of scheduled tasks. Airflow often sits at the center of business automation, so an incident may cascade into business intelligence, billing, customer communications, supply chain coordination, and cloud operations.
For your data, a compromised Airflow control plane may expose credentials, connection configurations, environment variables, workflow code, logs, and data accessible to Airflow’s service accounts. The practical impact depends on the permissions assigned to those accounts and on how broadly Airflow is connected across your environment.
For your reputation and compliance posture, a security incident involving regulated personal information, financial data, or health information may trigger contractual notification obligations, regulatory review, incident-response costs, and loss of customer confidence. The highest risk exists where untrusted or broadly distributed users can contribute DAGs, or where access governance around workflow repositories and deployment processes is weak.
Regional Bank Data Operations: A regional bank uses Airflow to coordinate anti-money-laundering analytics, daily account reporting, and data transfers between internal systems. If an unauthorized party can introduce a malicious workflow, they may gain access to sensitive processing infrastructure, creating operational disruption and potential exposure of customer information.
Mid-Market Healthcare Provider: A healthcare organization relies on Airflow for data warehouse refreshes and claims-processing integrations. A compromise could interrupt time-sensitive reporting and create access paths to systems containing protected health information, requiring a careful legal, security, and privacy assessment.
North American Retailer: A retailer uses Airflow to synchronize inventory, order, pricing, and marketing data across cloud platforms. An attacker who compromises the workflow environment could alter scheduled jobs, interrupt fulfillment data, or access cloud credentials that support broader business systems.
Large Software-as-a-Service Provider: A software provider allows multiple engineering teams to contribute workflow definitions to a shared Airflow platform. Without firm separation between workflow authors and high-privilege Airflow services, one compromised developer account or malicious contribution could become a platform-wide control-plane incident rather than a contained application issue.
apache-airflow package below 3.3.0.CVE-2026-33264 is a reminder that workflow orchestration platforms are high-value control points, not just back-office tools. IntegSec can help you assess Airflow exposure, test access boundaries, validate cloud and credential segmentation, and prioritize remediation based on the systems your workflows can reach. A focused penetration test can identify the gaps that a version upgrade alone may not address. Contact IntegSec to strengthen your Airflow security posture and reduce cybersecurity risk across your automation environment.
CVE-2026-33264 is an insecure deserialization vulnerability in Apache Airflow’s serialized DAG processing path. The root cause is unrestricted import_string() processing of attacker-controlled class paths through BaseSerialization.deserialize(). When the Scheduler or API Server loads a serialized DAG containing a malicious trigger, the vulnerable path can cause attacker-selected code to execute in those higher-privilege Airflow processes. This violates Airflow’s intended security boundary, in which DAG-author code should not execute inside Scheduler or API Server processes.
The affected package is apache-airflow before version 3.3.0. The NVD identifies the weakness as CWE-502, Deserialization of Untrusted Data. The CISA-assigned CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scoring 9.8 Critical. This indicates a network-reachable issue with low attack complexity, no required privileges or user interaction in the scoring model, and high potential impact to confidentiality, integrity, and availability.
Verify deployed package versions and identify whether vulnerable Scheduler or API Server nodes process serialized DAGs. Do not test exploit payloads against production systems; validate versions, configuration, and deployment controls first.
Version Verification: Systems reporting any Apache Airflow version below 3.3.0 should be treated as vulnerable until upgraded and validated. Containerized environments should be checked through image manifests, deployment specifications, and running pods rather than only a workstation dependency file.
Configuration Review: Inspect [core] allowed_deserialization_classes and allowed_deserialization_classes_regexp in the effective Airflow configuration. Broad wildcards, permissive regular expressions, or unnecessary classes increase exposure to unsafe deserialization paths.
Log Indicators: Review Scheduler and API Server logs for unexpected import failures, unusual trigger deserialization events, stack traces involving BaseSerialization.deserialize() or import_string(), and Python module names not approved for the environment.
Behavioral Indicators: Investigate unplanned child processes, unexpected outbound connections from Scheduler or API Server hosts, changes to DAG files, new environment variables, altered connection settings, or abnormal use of Airflow service-account credentials.
apache-airflow 3.3.0 or later using the official Apache release and your normal change-management process. Validate the deployed package or container image after rollout, restart affected Airflow services where required by your deployment model, and monitor job execution for compatibility issues. Apache identifies 3.3.0 as the patched version.lists.apache+1[core] allowed_deserialization_classes to a narrow, documented allowlist required by approved workflows. Avoid broad patterns in allowed_deserialization_classes_regexp. Limit DAG author access, pause unreviewed DAG deployment pipelines, enforce peer review for workflow changes, and isolate Airflow service accounts from unnecessary cloud, database, and secret-management privileges. Apache specifically recommends a narrow allowlist as a defense-in-depth measure.allowed_deserialization_classes allowlist and avoid permissive regular-expression rules unless they are necessary and formally reviewed.