CVE-2023-51702

Advisory

A vulnerability has been identified in versions of Airflow where, by using deferrable mode and a Kubernetes configuration file for authentication, the Airflow worker sends this configuration as an unencrypted dictionary to the triggerer, storing it in metadata. This process, coupled with certain Airflow versions, also results in the unmasked logging of the configuration dictionary in the triggerer service. Consequently, unauthorized individuals could potentially access and exploit the Kubernetes cluster using the exposed configuration details.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51702