Filtered by vendor Apache
Subscriptions
Filtered by product Airflow Cncf Kubernetes
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-27173 | 1 Apache | 2 Airflow Cncf Kubernetes, Apache-airflow-providers-cncf-kubernetes | 2026-05-20 | 8.7 High |
| JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks. | ||||
| CVE-2023-33234 | 1 Apache | 2 Airflow Cncf Kubernetes, Apache-airflow-providers-cncf-kubernetes | 2024-11-21 | 7.2 High |
| Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability. | ||||
Page 1 of 1.