CVE-2023-33234

Published: May 30, 2023Modified: Jul 2, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

Affected (1)

Products: Apache: Apache Airflow Providers Cncf Kubernetes

1 product

Apache Airflow Providers Cncf Kubernetes

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Apache Airflow Providers Cncf Kubernetes	From 5.0.0 to 7.0.0

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (2)

https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.