CVE-2026-33264: Apache Airflow <3.3.0 allows deserialization of attacker-controlled class paths in BaseSerialization.deserialize(), enabling DAG authors to trigger RCE in the Scheduler/API Server via malicious serialized DAGs.
CVE-2026-33264 is verified against apache/airflow · PyPI affected versions: < 3.3.0 fixed version: 3.3.0 vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00271.
pruva-verify REPRO-2026-00271 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00271/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh CVE-2026-33264 / GHSA-2943-9672-r45w: Apache Airflow BaseSerialization.deserialize() performs unrestricted import_string() on attacker-controlled class paths when the Scheduler/API Server loads a serialized DAG. A DAG author can embed a malicious Trigger class whose class path is included in the serialized DAG, causing code execution in the Scheduler/API Server process. This violates the Airflow security boundary that DAG-author code must only run in task workers, never in Scheduler/API Server.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.