Skip to content
fr Sign in
Not rated

CVE-2026-27173 JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to…

Description

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

Affected products and versions

Product Affected versions Fixed in
Apache Airflow CNCF Kubernetes Provider 10.17 earliest → < 10.17.0 10.17.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Airflow CNCF Kubernetes Provider

The 3 CVEs of Apache Airflow CNCF Kubernetes Provider →
CVE-2023-51702 Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the… Not rated CVE-2023-33234 Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar… Not rated
Track this CVE