EUVD-2026-30977
GHSA-524w-vq63-2xhf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Reading pod objects uses the network-reachable Kubernetes API (AV:N), needs only read-only pod RBAC (PR:L), and crosses the K8s boundary into Airflow's DB (S:C) with C:H/I:H and limited A:L.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.
AnalysisAI
Privilege escalation in the Apache Airflow CNCF Kubernetes provider (versions before 10.17.0) exposes worker JWT tokens to any principal holding read-only access to Kubernetes Pods. When Airflow runs with the KubernetesExecutor, the scheduler embeds a 'workload'-scoped Execution API JWT in the pod's workload payload, so a low-privileged user who can read pod objects can harvest that token and impersonate a running task via the Task SDK, including actions that mutate Airflow database state. There is no public exploit identified at time of analysis; EPSS is 0.01% (2nd percentile) and CISA SSVC rates exploitation as none, so this is an insider/lateral-movement risk rather than a mass-exploited flaw.
Technical ContextAI
The affected component is Apache Airflow's CNCF Kubernetes provider used by the KubernetesExecutor, which launches each task in its own worker pod. Airflow's Execution API authenticates workers with JWTs of two scopes: a 'workload'-scoped token (lifetime tied to [scheduler] task_queued_timeout, default 600 seconds) generated by the scheduler and embedded in the workload JSON delivered to the executor/pod, and a short-lived 'execution'-scoped token (default 10 minutes) issued at the /run endpoint and transparently refreshed by JWTReissueMiddleware. The vulnerability arises because the long-lived workload token is placed into the pod definition, which is readable through the Kubernetes API by anyone with get/list RBAC on Pods. This is a CWE-538 issue (insertion of sensitive information into an externally-accessible location): a Kubernetes RBAC read boundary leaks a credential that grants Airflow application/database privileges, which is why the vendor scored it with a changed scope (S:C).
RemediationAI
Vendor-released patch: upgrade the Apache Airflow CNCF Kubernetes provider to 10.17.0 or later, which the fix in https://github.com/apache/airflow/pull/60108 delivers by separating long-lived workload tokens from the standard execution-scoped tokens and no longer exposing reusable worker credentials; see the advisory at https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw. If you cannot upgrade immediately, tighten Kubernetes RBAC so that only trusted service accounts hold get/list/watch on Pods in the Airflow worker namespace (side effect: breaks tooling or users that legitimately inspect pods), isolate worker pods in a dedicated namespace to limit who can read them, and reduce [scheduler] task_queued_timeout to shrink the workload token's validity window (trade-off: a lower timeout also causes the scheduler to reap queue-starved tasks sooner, which can fail tasks under a backed-up queue). These are compensating controls only - they narrow the exposure window but do not remove the token from the pod definition.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today