An Airflow operator’s executor_config field is processed by the deserialization layer by calling import_string() on a class name extracted from serialized data without validating the imported type. This allows a DAG author to inject an arbitrary callable, such as subprocess.check_output or builtins.eval, leading to execution of code on the system that hosts the Airflow Scheduler or API server. The weakness is identified as CWE‑502, describing deserialization of untrusted data. The exploit can compromise confidentiality, integrity, and availability of the underlying host because it gives the attacker full code execution rights.

Apache Software Foundation’s Apache Airflow is affected. All releases that do not contain the 3.3.1 onward fix are vulnerable, including the current 3.2.x series and any intermediate releases. The vulnerability is triggered through the standard DAG serialization mechanism and does not require any custom or non‑default configuration to be present.

The CVSS score of 8.8 indicates high severity, and coupled with its presence in the core deserialization logic, it poses a serious risk. The vulnerability exists in the Scheduler’s background loop and the authenticated API endpoint, meaning it can be triggered simply by creating or modifying a DAG; no special network access beyond normal DAG author privileges is needed. The risk remains considerable because the code runs internally with database credentials and a JWT signing secret, providing the attacker with potent system resources. The EPSS score of less than 1% suggests low but non‑zero exploitation probability, and although the vulnerability is not listed in the CISA KEV catalog, it remains acute until the software is updated.