PT-2026-42001 · Apache · Apache Airflow

Anish Giri · CVE-2026-27173 · Published 2026-05-19 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apache Airflow (affected versions not specified)

Description JWT tokens used by workers in Kubernetes Executors are exposed to users with read-only access to Kubernetes Pods. This exposure allows users with limited permissions to perform actions intended only for running tasks via the Task SDK, potentially enabling the modification of the Airflow Database state for those tasks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2026-27173

ECHO-B981-D563-1DF6

GHSA-524W-VQ63-2XHF

PYSEC-2026-2365

Affected Products

Apache Airflow

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27173.json · Exploit
• https://github.com/apache/airflow/pull/60108 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27173 · Security Note
• https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-524w-vq63-2xhf · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2365 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27173 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://pypi.python.org · Note
• https://t.me/cveNotify/181256 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/19/35 · Note
• https://twitter.com/vuldb/status/2056988937605026224 · Twitter Post
• https://t.me/cveNotify/165762 · Telegram Post
• https://github.com/advisories/GHSA-524w-vq63-2xhf · Note
• https://t.me/CVEtracker/55466 · Telegram Post