Apache Airflow Cncf Kubernetes
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apache Airflow Cncf Kubernetes.
By the Year
In 2026 there have been 0 vulnerabilities in Apache Airflow Cncf Kubernetes. Airflow Cncf Kubernetes did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 1 | 6.50 |
| 2023 | 1 | 7.20 |
It may take a day or so for new Airflow Cncf Kubernetes vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Airflow Cncf Kubernetes Security Vulnerabilities
Confidential Kubernetes Config Leak in Airflow 2.3.02.6.0 Deferrable Mode
CVE-2023-51702
6.5 - Medium
- January 24, 2024
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.
Insertion of Sensitive Information into Log File
Apache Airflow CNCF Kubernetes provider 5.0.0 XCom sidecar image RCE
CVE-2023-33234
7.2 - High
- May 30, 2023
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Airflow Cncf Kubernetes or by Apache? Click the Watch button to subscribe.
