The vulnerability exists in the BaseSerialization.deserialize() function of Apache Airflow versions before 3.3.0. It permits unrestricted import_string() calls on attacker-controlled class paths when loading serialized DAGs in the Scheduler or API Server. This enables a DAG author to embed malicious triggers that execute arbitrary code remotely within these processes, violating the intended security boundary that DAG-author code must not run in the Scheduler or API Server. The issue is addressed by upgrading to Apache Airflow 3.3.0 or later. As a defense-in-depth measure, the [core] allowed_deserialization_classes configuration can be restricted to a narrow allowlist to limit deserialization to trusted classes.

Successful exploitation allows remote code execution on the Airflow Scheduler or API Server processes by a DAG author, crossing the security boundary that normally isolates DAG-author code from these critical components. This could lead to full compromise of the Airflow server environment where the Scheduler or API Server runs.

A fix is available by upgrading Apache Airflow to version 3.3.0 or later. Additionally, deployments where DAG-author trust is limited should configure the [core] allowed_deserialization_classes setting to a narrow allowlist to restrict deserialization to safe classes. No other official remediation details are provided, so users should check the vendor advisory for updates.