PT-2026-42001 · Apache · Apache Airflow

Anish Giri · Published 2026-05-19 · Updated 2026-06-03 · CVE-2026-27173

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apache Airflow (affected versions not specified)

Description JWT tokens used by workers in Kubernetes Executors are exposed to users with read-only access to Kubernetes Pods. This exposure allows users with limited permissions to perform actions intended only for running tasks via the Task SDK, potentially enabling the modification of the Airflow Database state for those tasks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2026-27173

GHSA-524W-VQ63-2XHF

Affected Products

Apache Airflow

References · 11

• https://github.com/apache/airflow/pull/60108 · Patch
• https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27173 · Security Note
• https://osv.dev/vulnerability/GHSA-524w-vq63-2xhf · Vendor Advisory
• https://github.com/apache/airflow · Note
• http://openwall.com/lists/oss-security/2026/05/19/35 · Note
• https://t.me/cveNotify/165762 · Telegram Post
• https://twitter.com/oss_security/status/2057007640287252530 · Twitter Post
• https://t.me/CVEtracker/55466 · Telegram Post
• https://twitter.com/vuldb/status/2056988937605026224 · Twitter Post
• https://twitter.com/CVEnew/status/2056870187056398632 · Twitter Post