Apache Airflow Cncf Kubernetes
By the Year
In 2024 there have been 1 vulnerability in Apache Airflow Cncf Kubernetes with an average score of 6.5 out of ten. Last year Airflow Cncf Kubernetes had 1 security vulnerability published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Airflow Cncf Kubernetes in 2024 could surpass last years number. Last year, the average CVE base score was greater by 0.70
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 1 | 6.50 |
| 2023 | 1 | 7.20 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Airflow Cncf Kubernetes vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Airflow Cncf Kubernetes Security Vulnerabilities
Since version 5.2.0
CVE-2023-51702
6.5 - Medium
- January 24, 2024
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.
Insertion of Sensitive Information into Log File
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0
CVE-2023-33234
7.2 - High
- May 30, 2023
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Airflow Cncf Kubernetes or by Apache? Click the Watch button to subscribe.
