Read the docs
TI-2026-21615 Aliases CVE-2026-27173GHSA-524w-vq63-2xhf

Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

Priority LOW 37CWE-538Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix Fixed Apache Airflow CNCF Kubernetes provider (Apache Software Foundation): 10.17.0apache-airflow-providers-cncf-kubernetes (PyPI): 10.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow CNCF Kubernetes providerbefore 10.17.010.17.0Patch availableCNA
—apache-airflow-providers-cncf-kubernetes (PyPI)before 10.17.010.17.0Patch availableGHSA-524w-vq63-2xhf
  • Apache Airflow CNCF Kubernetes provider VendorApache Affected before 10.17.0 Fixed in 10.17.0 Patch available CNA
  • apache-airflow-providers-cncf-kubernetes (PyPI) Vendor— Affected before 10.17.0 Fixed in 10.17.0 Patch available GHSA-524w-vq63-2xhf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-cncf-kubernetes:*:*:*:*:*:*:*:*before 10.17.0VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-cncf-kubernetes:*:*:*:*:*:*:*:* Versions before 10.17.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow CNCF Kubernetes provider (Apache Software Foundation) Fixed in 10.17.0
  • Fix · GHSA-524w-vq63-2xhf apache-airflow-providers-cncf-kubernetes (PyPI) Fixed in 10.17.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27173
  2. 2026-10-03 Alias added: GHSA-524w-vq63-2xhf

References

Patch 1

Advisory 3

Other 1

  • TI-2023-16406 Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration CVSS 3.1HIGH 7.2
  • TI-2023-28348 Cleartext storage of sensitive information in Apache Airflow CNCF Kubernetes provider CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences