Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Priority LOW 37CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01544 75th percentileScored 2026-11-07
Fix Fixed apache-airflow-providers-cncf-kubernetes (PyPI): 7.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Airflow CNCF Kubernetes Provider | 5.0.0 – 6.1.0 | — | No fix listed | CNA |
| — | apache-airflow-providers-cncf-kubernetes (PyPI) | 5.0.0 to before 7.0.0 | 7.0.0 | Patch available | GHSA-2rx4-9f5h-9gjf |
- Apache Airflow CNCF Kubernetes Provider VendorApache Affected 5.0.0 – 6.1.0 Fixed in — No fix listed CNA
- apache-airflow-providers-cncf-kubernetes (PyPI) Vendor— Affected 5.0.0 to before 7.0.0 Fixed in 7.0.0 Patch available GHSA-2rx4-9f5h-9gjf
Remediation
- Fix · GHSA-2rx4-9f5h-9gjf apache-airflow-providers-cncf-kubernetes (PyPI) Fixed in 7.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-33234
- 2026-10-03 Alias added: GHSA-2rx4-9f5h-9gjf
References
More Apache-airflow-providers-cncf-kubernetes vulnerabilities
- TI-2026-21615 Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments CVSS 3.1HIGH 8.7
- TI-2023-28348 Cleartext storage of sensitive information in Apache Airflow CNCF Kubernetes provider CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-33234 · CVE Program
- CVE-2023-33234 · NVD
- FIRST EPSS
- GHSA-2rx4-9f5h-9gjf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences