CVEFinder.io

CVE-2023-51702

🔶 medium
Summary

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer lo

Description

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.

This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.

CVSS Score
6.5
Medium
EPSS Score
0.4
Exploit Probability
Published Date
2024-01-24
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 365,987 vulnerabilities in our database.

#195,533
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jan 29, 2024
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Hussein Awala Hussein Awala (remediation developer)
SSVC data provided by CISA
Last Modified 2026-07-02
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE IDs (Weakness Types)
CWE-312 CWE-532

📦 Affected Products 2

Vendor Product Status Affected Versions
apache airflow Affected
≥ 2.3.0 < 2.6.1
apache airflow_cncf_kubernetes Affected
≥ 5.2.0 < 7.0.0

🔗 References 5

http://www.openwall.com/lists/oss-security/2024/01/24/3
Mailing List Third Party Advisory
https://github.com/apache/airflow/pull/29498
Issue Tracking Patch
https://github.com/apache/airflow/pull/30110
Patch
https://github.com/apache/airflow/pull/36492
Issue Tracking Patch
https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr0...
Mailing List Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-75158 🔶 medium 4.3 0.6 Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting ... 2026-09-21
CVE-2026-82355 🔶 medium 4.2 0.7 When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airf... 2026-09-21
CVE-2026-86473 ⛔ critical 9.1 0.8 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client ... 2026-09-21
CVE-2026-54183 🔶 medium 4.3 0.5 Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The mas... 2026-08-12
CVE-2026-58076 ⚠️ high 8.8 0.5 Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken fr... 2026-08-12
CVE-2026-59242 🔶 medium 5.4 0.6 Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload th... 2026-08-12
These CVEs affect the same products