CVE-2026-58076: CWE-502: Deserialization of Untrusted Data in Apache Software Foundation Apache Airflow
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/details`. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a **different sink from CVE-2026-33264**, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of `BaseException`.
AI Analysis
Technical Summary
Apache Airflow's serialization mechanism reconstructs exception nodes by calling import_string() on class names from serialized data and instantiating them with arguments from the same data without restricting what can be imported. This allows a malicious DAG author to place values in the executor_config that cause arbitrary callables to be imported and invoked, such as subprocess.check_output or builtins.eval. The vulnerable code runs in the Scheduler and API server, components that hold metadata database credentials and JWT signing secrets and should not execute DAG author code. This vulnerability is distinct from CVE-2026-33264 and affects deployments even if they patched that earlier issue. The recommended fix is to upgrade to Apache Airflow 3.3.1 or later, which enforces that only subclasses of BaseException can be imported during deserialization.
Potential Impact
An attacker with the ability to author DAGs can exploit this vulnerability to execute arbitrary code within the Scheduler or API server processes. These components hold sensitive credentials and secrets, so exploitation could lead to credential compromise and unauthorized actions within the Airflow environment. No special configuration is required to be vulnerable. This elevates the risk of privilege escalation and data exposure within affected Airflow deployments.
Mitigation Recommendations
Users should upgrade to Apache Airflow version 3.3.1 or later, which restricts deserialization imports to subclasses of BaseException, effectively mitigating this vulnerability. There is no indication of an official patch or temporary workaround other than upgrading. Deployments that patched CVE-2026-33264 must still upgrade to 3.3.1 or later to address this distinct vulnerability.
CVE-2026-58076: CWE-502: Deserialization of Untrusted Data in Apache Software Foundation Apache Airflow
Description
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/details`. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a **different sink from CVE-2026-33264**, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of `BaseException`.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Airflow's serialization mechanism reconstructs exception nodes by calling import_string() on class names from serialized data and instantiating them with arguments from the same data without restricting what can be imported. This allows a malicious DAG author to place values in the executor_config that cause arbitrary callables to be imported and invoked, such as subprocess.check_output or builtins.eval. The vulnerable code runs in the Scheduler and API server, components that hold metadata database credentials and JWT signing secrets and should not execute DAG author code. This vulnerability is distinct from CVE-2026-33264 and affects deployments even if they patched that earlier issue. The recommended fix is to upgrade to Apache Airflow 3.3.1 or later, which enforces that only subclasses of BaseException can be imported during deserialization.
Potential Impact
An attacker with the ability to author DAGs can exploit this vulnerability to execute arbitrary code within the Scheduler or API server processes. These components hold sensitive credentials and secrets, so exploitation could lead to credential compromise and unauthorized actions within the Airflow environment. No special configuration is required to be vulnerable. This elevates the risk of privilege escalation and data exposure within affected Airflow deployments.
Mitigation Recommendations
Users should upgrade to Apache Airflow version 3.3.1 or later, which restricts deserialization imports to subclasses of BaseException, effectively mitigating this vulnerability. There is no indication of an official patch or temporary workaround other than upgrading. Deployments that patched CVE-2026-33264 must still upgrade to 3.3.1 or later to address this distinct vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-06-28T15:16:00.339Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c97cebf8831d539c533c6
Added to database: 08/12/2026, 15:57:02 UTC
Last enriched: 08/12/2026, 16:16:46 UTC
Last updated: 08/12/2026, 23:48:51 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.