CVE-2023-33234CWE-74

Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration

High · published May 30, 2023

CVSS v3.1
7.2
EPSS
2%
Percentile
74.8
In the wild
Unconfirmed
What it is

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.

In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01544 · 74.8th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2023-05-30T10:56Z
EPSS history
Timeline
  • 30 MAY 10:56Z
    Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
    cvelistv5