CVE-2023-33234

CVE-2023-33234 affects the Apache Airflow CNCF Kubernetes provider (version 5.0.0). Affected component: xcom sidecar image and resources via a misconfigured Airflow connection, enabling arbitrary code execution. Exploitation requires elevated permissions (Operator/Admin) to alter the connection. ...

CVE-2023-51702

CVE-2023-51702 describes a vulnerability in Apache Airflow’s CNCF Kubernetes provider where, since version 5.2.0, using deferrable mode with the Kubernetes config file path causes the worker to serialize the file contents into a dictionary and store it in metadata unencrypted. For Airflow version...

CVE-2026-27173

CVE-2026-27173 affects the Apache Airflow CNCF Kubernetes provider where JWT tokens used by workers in Kubernetes Executors can be exposed to users with read-only access to Kubernetes Pods. The issue arises from tokens being exposed in command-line arguments, potentially enabling read-only users ...