CVE-2026-27173

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/60108	Issue Tracking Patch
https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/19/35	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apache-airflow-providers-cncf-kubernetes:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-19 20:16

Updated : 2026-07-24 09:10

NVD link : CVE-2026-27173

Mitre link : CVE-2026-27173

CVE.ORG link : CVE-2026-27173

JSON object : View

Products Affected

apache

apache-airflow-providers-cncf-kubernetes

CWE

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

{"id": "CVE-2026-27173", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27173", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T19:56:34.624709Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow CNCF Kubernetes provider", "versions": [{"status": "affected", "version": "0", "lessThan": "10.17.0", "versionType": "semver"}], "packageName": "apache-airflow-providers-cncf-kubernetes", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T20:16:17.440", "references": [{"url": "https://github.com/apache/airflow/pull/60108", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/19/35", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-538"}]}], "descriptions": [{"lang": "en", "value": "JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks."}, {"lang": "es", "value": "Los tokens JWT que eran utilizados por los workers en los ejecutores de Kubernetes han sido expuestos a usuarios que ten\u00edan acceso de solo lectura a los Pods de Kubernetes. Esto podr\u00eda permitir a usuarios con solo acceso de solo lectura realizar acciones que solo estaban disponibles para tareas en ejecuci\u00f3n a trav\u00e9s del SDK de Tareas y potencialmente permitir modificar el estado de la base de datos de Airflow para las tareas."}], "lastModified": "2026-07-24T09:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache-airflow-providers-cncf-kubernetes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A66CC43F-A012-4082-BBB0-60965A8BDDF8", "versionEndExcluding": "10.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}