High WID-SEC-2026-1595 2 CVEs

Apache Airflow: Mehrere Schwachstellen

Published May 19, 2026 · Updated May 19, 2026 · de-DE

Vendor: Apache Product: Airflow Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 2

High 8.7

CVE-2026-27173

Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK an…

Apache Software Foundation Apache Airflow CNCF Kubernetes provider apache-airflow-providers-cncf-kubernetes PyPI

May 19, 2026
Medium 5.3

CVE-2026-42526

Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped …

Apache Software Foundation Apache Airflow Amazon provider apache-airflow-providers-amazon PyPI

May 19, 2026

Revision history

2026-05-19 #1
Initiale Fassung

References

OSS Security Mailing List vom 2026-05-19
https://seclists.org/oss-sec/2026/q2/607
OSS Security Mailing List vom 2026-05-19
https://seclists.org/oss-sec/2026/q2/608
CVERecord vom 2026-05-19
https://www.cve.org/CVERecord?id=CVE-2026-27173
CVERecord vom 2026-05-19
https://www.cve.org/CVERecord?id=CVE-2026-42526