Apache Airflow 3.3.1 patches three DAG-author RCE bugs in the scheduler and API server

Apache Airflow has shipped 3.3.1 to close three important-severity remote code execution issues that let a DAG author run code inside the scheduler and, in one case, the API server. Those processes hold metadata database credentials and the JWT signing secret, and Airflow’s security model treats them as places that must never execute DAG-author code. No non-default configuration is required for any of the three bugs.

The broadest issue is CVE-2026-58076, which affects Apache Airflow from 3.0.0 before 3.3.1. The serialization layer rebuilt exception nodes by importing a class name taken from the serialized blob and instantiating it with arguments from the same data, with no useful restriction on what could be imported. An operator’s executor_config can reach that path, so a DAG author could force an arbitrary callable to load and run. The scheduler hits the code while reconstructing serialized DAGs in its normal loop. The API server hits it on authenticated reads such as a DAG details request. The project notes this is a different sink from CVE-2026-33264, which covered only the trigger branch of the same deserializer, so earlier upgrades for that advisory do not fix this one. The 3.3.1 fix limits the imported class to a subclass of BaseException. Jan Kahmen found the issue; Jarek Potiuk developed the remediation.

Two further bugs are specific to the 3.3.0 line and are fixed in 3.3.1. CVE-2026-67260 stems from 3.3.0 moving human-in-the-loop tasks into an awaiting_input state swept by the scheduler. That sweep deserializes a task instance’s next_kwargs without an allow-list. A DAG author who controls that value through the task execution API can force an arbitrary module import and object instantiation inside the scheduler, or kill the scheduler job. The sweep runs unconditionally about every 15 seconds. Versions before 3.3.0 are not affected because those tasks deferred onto the triggerer instead. Erik Villegas found the flaw; Potiuk fixed it.

CVE-2026-67587 is a related gadget on a separate path in 3.3.0 before 3.3.1. The Task SDK rebuilds a Callback from serialized data by re-running its constructor, which imports the module named in the stored callback path. SyncCallback is an Airflow class, so it passes the default allowed_deserialization_classes list and tightening that setting does not help. When the scheduler’s awaiting_input timeout sweep deserializes attacker-controlled next_kwargs, an arbitrary module can load inside the scheduler. Nguyen Van Hiep of MBBank found it; Potiuk handled the fix.

The three issues use different deserialization gadgets. Applying a fix for one does not cover the others. Operators on affected 3.x releases should move to apache-airflow 3.3.1 or later.