CVE-2026-27173Disclosure(apache / apache-airflow-providers-cncf-kubernetes)

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/apache/airflow/pull/60108

Vendor / third-party advisories

Weakness type (CWE)

CWE-538

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

apache-airflow-providers-cncf-kubernetes

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 1d ago at 2 mentions (2026-05-19); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

apache

Products

apache-airflow-providers-cncf-kubernetes

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

General

250.0%

Referenced assets5 URLs

By indicator

Full discourse4 posts

Open Source Security mailing list@oss_security142d
Disclosure
CVE-2026-27173: Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line https://www.openwall.com/lists/oss-security/2026/05/19/35 CVE-2026-42526: Apache Airflow Amazon provider: Unauthorized access in AWS Secrets Manager & SSM Parameter Store backends https://www.openwall.com/lists/oss-security/2026/05/19/36
Post summary
The text announces two new CVE disclosures for Apache Airflow providers, providing concise technical descriptions but lacking PoC, exploit code, patch information, or evidence of active exploitation.
00071467
4.7K followersView on X
VulDB 🛡@vuldb142d
General
A lot of offensive activities were identified targeting Apache Airflow CNCF Kubernetes Provider (CVE-2026-27173) https://vuldb.com/vuln/364721/cti
Post summary
The post mentions that many attacks have targeted the Apache Airflow CNCF Kubernetes Provider CVE‑2026‑27173, but offers no additional detail on exploits, PoC, or mitigations.
0000055
2.2K followersView on X
CVE@CVEnew142d
Disclosure
CVE-2026-27173 JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just … https://www.cve.org/CVERecord?id=CVE-2026-27173
Post summary
The tweet announces a vulnerability (CVE-2026-27173) involving exposed JWT tokens in Kubernetes Executors, but provides no proof of exploit, active attack information, or patch details.
0000095
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds143d
General
CVE-2026-27173 CVE-2026-27173 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27173
Post summary
The text references CVE-2026-27173 and includes a link to a vulnerability details page, but provides no further technical or exploitation information.
0000047
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	apache-airflow-providers-cncf-kubernetes	-	-	-

Explore more

Back to dashboard apache CVEs apache-airflow-providers-cncf-kubernetes vulnerabilities

What researchers are saying

CVE-2026-27173

Open Source Security mailing list@oss_securityDisclosure

The text announces two new CVE disclosures for Apache Airflow providers, providing concise technical descriptions but lacking PoC, exploit code, patch information, or evidence of active exploitation.

VulDB 🛡@vuldbGeneral

The post mentions that many attacks have targeted the Apache Airflow CNCF Kubernetes Provider CVE‑2026‑27173, but offers no additional detail on exploits, PoC, or mitigations.

CVE@CVEnewDisclosure

The tweet announces a vulnerability (CVE-2026-27173) involving exposed JWT tokens in Kubernetes Executors, but provides no proof of exploit, active attack information, or patch details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text references CVE-2026-27173 and includes a link to a vulnerability details page, but provides no further technical or exploitation information.