Information disclosure in Apache Airflow CNCF Kubernetes provider - CVE-2026-27173
Published: August 25, 2026
Vulnerability identifier: #VU145286
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-27173
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose JWT tokens and perform actions available to running tasks, potentially modifying task state in the Airflow database.
The vulnerability exists due to improper exposure of sensitive information in KubernetesExecutor command-line arguments when users with read-only access inspect Kubernetes pods. A remote user can read exposed JWT tokens from pod information to disclose JWT tokens and perform actions available to running tasks, potentially modifying task state in the Airflow database.
Exploitation requires read-only access to Kubernetes pods.
Affected software
Apache Airflow CNCF Kubernetes provider
How to mitigate CVE-2026-27173
Install security update from vendor's website.
Apache Airflow CNCF Kubernetes provider - update to 10.17.0