Apache Airflow EUVD-2026-33580

Apache Airflow must be deployed with the KubernetesExecutor (not LocalExecutor, CeleryExecutor, or SequentialExecutor) on a version below 3.2.2, since the leak occurs specifically when the executor builds airflow CLI invocations with the JWT embedded in argv for worker pods. The attacker needs a pre-existing low-privilege foothold (PR:L) that grants visibility into worker process arguments - concretely: kubectl exec into the worker pod, kubectl get pod -o yaml on the worker (the token appears in spec.containers[].args/command), read access to /proc/<pid>/cmdline from a co-located container sharing the process namespace, or node-level shell on the Kubernetes host. Exploitation is bounded by the workload token's lifetime (tied to scheduler task_queued_timeout, default 600 seconds in patched documentation; pre-patch behavior matched whatever token lifetime was issued), and no user interaction is required once the token is captured. Clusters that strictly isolate the Airflow namespace and forbid non-admin pod inspection materially limit reach.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network-reachable impact once a low-privileged actor reads the token from process arguments, but the PR:L requirement means an attacker must already have some foothold - typically pod-exec, Kubernetes API read access to pod specs, or local shell on a worker node - before the token becomes useful. EPSS at 0.02% (6th percentile) and absence from CISA KEV indicate no observed mass exploitation, consistent with the prerequisite of pre-existing cluster visibility. The 8.8 score is therefore best read as conditional severity: in a multi-tenant Kubernetes cluster where namespace isolation is the trust boundary, this is a meaningful privilege-escalation primitive; in a single-tenant cluster with no untrusted pod-exec users, real risk is lower. The tag 'Authentication Bypass' is a partial mischaracterization - this is credential leakage enabling impersonation rather than an auth-bypass primitive - verify intended classification with the Apache advisory.

An attacker with low-privileged access to the Kubernetes namespace running Airflow workers - for example a developer with pod-exec rights, a co-tenant pod with shared process namespace visibility, or read access to pod specs via the Kubernetes API - enumerates running airflow worker processes and extracts the JWT from the command-line arguments. They then replay the token against the Airflow Execution API to mark tasks running, fetch task state, or push crafted XComs and task outcomes, corrupting pipeline integrity and potentially pivoting to data destinations the worker is authorized to write to. No public proof-of-concept has been identified at time of analysis.