CVE-2026-27173 Apache Software Foundation CVE debrief

Who should care

Airflow operators, Kubernetes platform administrators, security teams managing cluster RBAC, and any environment where users have read access to Kubernetes Pods in a Kubernetes Executor deployment should treat this as relevant.

Technical summary

The source corpus indicates that JWT tokens associated with worker tasks in Kubernetes Executors were exposed to users who only had read-only Kubernetes Pod access. That exposure could enable actions intended for running tasks through Task SDK and may allow modification of Airflow database state for tasks. NVD listed the vulnerability as Awaiting Analysis at source time, and the advisory references point to Apache Airflow security material, including a remediation pull request and mailing-list notices.

Defensive priority

High. This is a low-privilege-to-high-impact exposure path: read-only pod visibility can cross a trust boundary and potentially lead to unauthorized task actions and integrity impact. Prioritize access control review and vendor remediation deployment.

Recommended defensive actions

• Apply the Apache Airflow fix referenced by the advisory and related pull request as soon as an official patched release is available.
• Restrict Kubernetes RBAC so only trusted administrators can read Pods in namespaces running Airflow Kubernetes Executors.
• Review who has read access to pod specifications, pod metadata, and any other cluster views that could expose worker-associated credentials.
• Rotate or invalidate any exposed task-related JWTs or related credentials where the environment may have been affected.
• Audit Airflow task activity and database changes for unexpected actions from Kubernetes Executor workers.
• Monitor Apache security advisories and the linked mailing-list notices for patch guidance and any affected-version details.

Evidence notes

Evidence in the supplied corpus includes the CVE description, NVD metadata, and Apache-linked references. NVD recorded the issue as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L with severity HIGH and vulnStatus 'Awaiting Analysis'. The source metadata also lists a secondary CWE-538 classification. Timing context: publishedAt 2026-05-19T20:16:17.440Z and modifiedAt 2026-05-19T21:16:41.920Z; these are the CVE record timestamps supplied in the corpus.

Official resources