CVE-2023-33234 json
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
published 2023-05-30 3 y ago modified 2026-07-07 4 mo ago also GHSA-2rx4-9f5h-9gjf , PYSEC-2026-1143 , EUVD-2023-1930
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
Patch / fix
- pypi apache-airflow-providers-cncf-kubernetes 7.0.0
- apache apache-airflow-providers-cncf-kubernetes 7.0.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.54% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow-providers-cncf-kubernetes | >=5.0.0, <7.0.0 |
7.0.0 |
Affected products
- Apache Software Foundation Apache Airflow CNCF Kubernetes Provider
- apache airflow_cncf_kubernetes
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
lists.apache.org
/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq
vendor-advisory, web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2023-33234
advisory
-
github.com
/apache/airflow
package
-
pypi.org
/project/apache-airflow-providers-cncf-kubernetes
package
-
github.com
/advisories/GHSA-2rx4-9f5h-9gjf
advisory
Sources
- CVE List CVE-2023-33234
- GitHub Advisory GHSA-2rx4-9f5h-9gjf
- NVD CVE-2023-33234
- OSV PYSEC-2026-1143
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.