CVE-2026-49298: Apache Airflow KubernetesExecutor JWT Token Exposure in Pod Specs

Technical summary

The vulnerability stems from JWT tokens being passed as command-line arguments to worker container specs in Kubernetes pods, rendering them visible in the pod specification object stored in etcd and retrievable via kubectl. An authenticated principal with `pods/get` permissions (or equivalent list/describe access) in the Airflow namespace can extract these tokens and replay them against the Execution API without additional authentication. This allows state-mutating operations (triggering runs, clearing runs, modifying task-related data) that would normally require task-context authorization. The root cause is insufficient credential handling in the KubernetesExecutor's pod template construction. Remediation involves two complementary patches: apache-airflow-providers-cncf-kubernetes 10.17.0+ (which modifies how credentials are injected into pods) and apache-airflow 3.2.2+ (which addresses the core Execution API side). Both upgrades are necessary to fully eliminate the exposure.

Business impact

Attackers with even minimal Kubernetes namespace read permissions can now escalate to arbitrary workflow manipulation and data exfiltration. This is particularly damaging in multi-tenant or federated environments where Kubernetes read access is widely distributed—e.g., developers, platform engineers, or monitoring tools. The ability to trigger DAG runs, clear run history, or modify Variables and Connections can disrupt critical data pipelines, introduce backdoors into workflow logic, or expose sensitive credentials stored in Airflow's metadata layer. For organizations running sensitive ETL, analytics, or orchestration workloads, this represents a significant insider-risk and lateral-movement vector.

Affected systems

Only Apache Airflow deployments using the KubernetesExecutor are affected. Organizations using other executors (LocalExecutor, CeleryExecutor, etc.) are not exposed by this vulnerability. Affected versions are those prior to apache-airflow 3.2.2. The vulnerability is present regardless of whether airflow-providers-cncf-kubernetes has already been patched, because the core package also participates in credential handling. Deployments that have already upgraded airflow-providers-cncf-kubernetes to 10.17.0+ per CVE-2026-27173 are not fully protected until the core airflow package is also upgraded.

Exploitability

Exploitability is relatively straightforward for an attacker with Kubernetes namespace read access. No exploit code, privilege escalation, or social engineering is required beyond standard kubectl commands. The attack surface is live as long as worker pods are running, making the window of exposure continuous in active Airflow clusters. However, the attacker must already be authenticated to the Kubernetes API and have been granted read permissions—this is not an unauthenticated or pre-auth vulnerability. In environments with strict Kubernetes RBAC policies that limit namespace visibility, exposure may be reduced, though best practice should assume the worst case.

Remediation

Upgrade apache-airflow to version 3.2.2 or later. Organizations that have already applied the CVE-2026-27173 fix (airflow-providers-cncf-kubernetes 10.17.0+) must still perform this upgrade, as the two patches are complementary and address different parts of the credential-handling pipeline. Verify that both packages are at the required versions before considering the vulnerability resolved. No configuration changes or workarounds are known; patching is the only remediation path. Plan upgrades during a maintenance window to avoid disruption to running DAGs.

Patch guidance

Obtain apache-airflow 3.2.2 or later from the official Python Package Index (PyPI) or your organization's artifact repository. Consult the Apache Airflow release notes and migration guide to verify compatibility with your current version and any customizations. If your deployment also uses airflow-providers-cncf-kubernetes, ensure it is at version 10.17.0 or later (per CVE-2026-27173) before or concurrently with the core upgrade. Test the upgrade in a staging environment that mirrors your production KubernetesExecutor configuration, including worker pod templates and authentication settings. After upgrade, restart or redeploy Airflow scheduler and webserver services, and allow any running worker pods to drain gracefully before redeploying them with the patched version.

Detection guidance

Monitor for suspicious use of the Execution API endpoints by reviewing Airflow webserver logs and audit trails for unexpected DAG triggers, run clears, or Variable/Connection modifications. In Kubernetes, audit logs can reveal unexpected `pods/get` or `pods/list` API calls followed by suspicious activity within the Airflow cluster. If available, use a service mesh (e.g., Istio) or API gateway to log and alert on Execution API calls from unexpected service accounts. Additionally, review Kubernetes RBAC policies to identify and audit which identities have namespace read access; consider tightening permissions to a minimal set. Look for JWT token artifacts in pod descriptions or logs if you suspect compromise. Implement network policies to restrict which services can call the Execution API.

Why prioritize this

This is a HIGH-severity vulnerability (CVSS 8.8) combining a credible attack path with significant blast radius. The prerequisite for exploitation—Kubernetes read access—is common in federated and multi-tenant cloud environments. The ability to mutate workflow state and access sensitive data stored in Airflow (Variables, Connections, XComs) directly affects confidentiality, integrity, and availability of data pipelines. The fix is straightforward and low-risk, making this an ideal candidate for urgent patching. Organizations should prioritize this within their next maintenance window, particularly if their Airflow clusters handle critical or sensitive data, or if Kubernetes namespace access is distributed across development teams.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: attack vector Network (AV:N) because the Execution API is network-accessible; low attack complexity (AC:L) because no special conditions are needed beyond standard kubectl commands; low privilege required (PR:L) because an authenticated Kubernetes user is needed but read-only access is sufficient; no user interaction (UI:N); unchanged scope (S:U); and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) because an attacker can read sensitive data, modify workflow state, and disrupt pipeline availability. The score appropriately reflects the severity but notes that exploitation requires prior Kubernetes access, which is a mitigating factor in isolated or air-gapped deployments.

Frequently asked questions