Apache Airflow Apache Kafka provider

1 result · Clear filters · Feed

• High 8.8
  CVE-2026-86792

  Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

  Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes t…

  Apache Software Foundation Apache Airflow Apache Kafka provider apache-airflow-providers-apache-kafka PyPI
  Sep 16, 2026