SB2026082597 - Information disclosure in Apache Airflow CNCF Kubernetes provider

Description

This security bulletin contains information about 1 vulnerability.

1) Information disclosure (CVE-ID: CVE-2026-27173)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose JWT tokens and perform actions available to running tasks, potentially modifying task state in the Airflow database.

The vulnerability exists due to improper exposure of sensitive information in KubernetesExecutor command-line arguments when users with read-only access inspect Kubernetes pods. A remote user can read exposed JWT tokens from pod information to disclose JWT tokens and perform actions available to running tasks, potentially modifying task state in the Airflow database.

Exploitation requires read-only access to Kubernetes pods.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=0bcym88d5dplbygzdbf8typ9kg15m87k
• https://github.com/apache/airflow/pull/60108