HIGH7.2

PYSEC-2026-1143

Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration

Quick fix

PYSEC-2026-1143 — apache-airflow-providers-cncf-kubernetes: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-airflow-providers-cncf-kubernetes>=7.0.0'

Details

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.

In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow-providers-cncf-kubernetes

Introduced in: 5.0.0Fixed in: 7.0.0

Fixpip install --upgrade 'apache-airflow-providers-cncf-kubernetes>=7.0.0'

References

https://nvd.nist.gov/vuln/detail/CVE-2023-33234[ADVISORY]
https://github.com/apache/airflow[PACKAGE]
https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq[WEB]
https://pypi.org/project/apache-airflow-providers-cncf-kubernetes[PACKAGE]
https://github.com/advisories/GHSA-2rx4-9f5h-9gjf[ADVISORY]