Apache Airflow CNCF Kubernetes provider vulnerabilities
2 known vulnerabilities in Apache Airflow CNCF Kubernetes provider from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
2vulnerabilities
0critical
2high
0exploited
7.9average CVSS score
Latest first
- 8.7 High severity
Apache Airflow CNCF Kubernetes provider: Insertion of Sensitive Information into Externally-Accessible File or Directory
JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and
- 7.2 High severity
Apache Airflow CNCF Kubernetes Provider: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to