JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.
References
| Link | Resource |
|---|---|
| https://github.com/apache/airflow/pull/60108 | Issue Tracking Patch |
| https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/05/19/35 | Mailing List Third Party Advisory |
Configurations
History
02 Jul 2026, 16:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache apache-airflow-providers-cncf-kubernetes
|
|
| CPE | cpe:2.3:a:apache:apache-airflow-providers-cncf-kubernetes:*:*:*:*:*:*:*:* |
30 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/apache/airflow/pull/60108 - Issue Tracking, Patch | |
| References | () https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/05/19/35 - Mailing List, Third Party Advisory | |
| First Time |
Apache
Apache airflow Cncf Kubernetes |
|
| CPE | cpe:2.3:a:apache:airflow_cncf_kubernetes:*:*:*:*:*:*:*:* |
19 May 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.7 |
19 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-19 20:16
Updated : 2026-07-02 16:37
NVD link : CVE-2026-27173
Mitre link : CVE-2026-27173
CVE.ORG link : CVE-2026-27173
JSON object : View
Products Affected
apache
- apache-airflow-providers-cncf-kubernetes
CWE
CWE-538
Insertion of Sensitive Information into Externally-Accessible File or Directory