Apache Airflow CNCF Kubernetes Provider JWT Token Exposure Vulnerability

A vulnerability exists in the Apache Airflow CNCF Kubernetes provider, specifically in versions prior to 10.17.0. JWT tokens used by workers in Kubernetes Executors have been exposed to users with read-only access to Kubernetes Pods. This exposure could enable these users to perform actions available to running tasks via the Task SDK, potentially allowing them to modify the state of the Airflow Database for those tasks.

Impact

This vulnerability could lead to unauthorized actions being performed on behalf of tasks, including modifications to the Airflow Database related to those tasks.

Remediation

Users can update to Apache Airflow CNCF Kubernetes provider version 10.17.0 or later to address this vulnerability.