Skip to content
fr Sign in
Not rated

CVE-2023-33234 Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar…

Description

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

Affected products and versions

Product Affected versions Fixed in
Apache Airflow CNCF Kubernetes Provider 5.0 5.0.0 → 6.1.0 No fix stated
airflow_cncf_kubernetes 5.0 5.0.0 → 6.1.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Airflow CNCF Kubernetes Provider

The 3 CVEs of Apache Airflow CNCF Kubernetes Provider →
CVE-2026-27173 JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to… Not rated CVE-2023-51702 Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the… Not rated
Track this CVE