CVE-2026-33264: Apache Airflow DAG author RCE via unrestricted import_string() in BaseSerialization.deserialize()
CVE-2026-33264 is verified against apache/airflow · github affected versions: < 3.3.0 fixed version: 3.3.0 vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00277.
pruva-verify REPRO-2026-00277 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00277/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Apache Airflow prior to 3.3.0 is vulnerable to remote code execution when loading serialized DAG content. A bug in BaseSerialization.deserialize() allows unrestricted import_string() of attacker-controlled class paths, so a DAG author can embed a malicious trigger or class reference that causes execution on the Scheduler/API Server process. This crosses the Airflow trust boundary because DAG-author code must not execute in those processes. Affected versions are all before 3.3.0; users should upgrade to 3.3.0 or later. Defense-in-depth mitigation: restrict [core] allowed_deserialization_classes to a narrow allowlist when DAG-author trust is limited.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.