Apache Airflow’s BaseSerialization.deserialize() routine permits an attacker-controlled Scheduler or API Server to execute arbitrary Python code via an unrestricted import_string() call. A DAG author can embed malicious trigger logic, causing the server to import and run any class path present in the DAG definition, thereby enabling remote code execution that bypasses Airflow’s security boundaries. The flaw is classified as CWE‑502.

The vulnerability affects all deployments of Apache Airflow versions older than 3.3.0 that accept serialized DAG files from authors who are not fully trusted. Any Airflow instance running a Scheduler or API Server that processes such DAGs is at risk, regardless of the underlying operating system or cluster size. Administrators should examine all components that load or execute DAG definitions, including webserver, scheduler, and API services.

With a CVSS score of 9.8 the flaw is considered critical, and an EPSS score of 2 % indicates a modest but non‑negligible likelihood that it will be targeted. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector involves a DAG author introducing a malicious file into the Airflow environment, it is inferable that an attacker must have the ability to submit or modify DAGs, which is often limited to a trusted, internal user base. Successful exploitation would provide the attacker with code execution on the Airflow server, allowing full system compromise.