Vulnerabilities > Apache > Airflow Cncf Kubernetes

DATE CVE VULNERABILITY TITLE RISK
2024-01-24 CVE-2023-51702 Unspecified vulnerability in Apache Airflow and Airflow Cncf Kubernetes
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption.
network
low complexity
apache
6.5
2023-05-30 CVE-2023-33234 Unspecified vulnerability in Apache Airflow Cncf Kubernetes
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
network
low complexity
apache
7.2