| |
Vulnerability CVE-2023-33234
Published: 2023-05-30
| Description: |
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
|
Type:
CWE-74
References: |
https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq
|
|
|
Copyright 2026, cxsecurity.com
|
|
|
