Detections
Analytics

SCA: security update for apache-airflow-core (GHSA-5j6p-jrrm-6x94)

high Tenable Cloud Security Plugin ID 444544

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against
 the Execution API to be passed to the worker container as command-line arguments visible in the pod spec.
 An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. `pods/get` in the
 Airflow namespace) could harvest the JWT from `kubectl describe pod` output and then call state-mutating
 Execution API endpoints — triggering Dag runs, clearing runs, reading or writing Variables / Connections /
 XComs — as if they were a running task. Affects deployments using the `KubernetesExecutor`. Users are
 advised to upgrade to `apache-airflow` 3.2.2 or later. This is the airflow-core half of the same
 vulnerability addressed by [CVE-2026-27173](https://www.cve.org/CVERecord?id=CVE-2026-27173), which
 shipped the apache-airflow-providers-cncf-kubernetes side of the fix. Deployments that already upgraded
 `apache-airflow-providers-cncf-kubernetes` to 10.17.0 or later per the CVE-2026-27173 advisory should
 additionally upgrade `apache-airflow` to 3.2.2 or later to close the core-side surface — the two fixes are
 complementary, not duplicates. (CVE-2026-49298)

Solution

Update the apache-airflow-core library and its related packages to version 3.2.2 or later.

See Also

https://github.com/advisories/GHSA-5j6p-jrrm-6x94

Plugin Details

Severity: High

ID: 444544

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 7/9/2026

Updated: 7/9/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.94

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-49298

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/1/2026

Vulnerability Publication Date: 6/1/2026

Reference Information

CVE: CVE-2026-49298

cwe: CWE-538