CVE-2026-49298: Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

Synopsis

A JWT token exposure vulnerability in Apache Airflow's KubernetesExecutor allows an authenticated attacker with limited Kubernetes read access to steal worker pod authentication tokens from pod spec command-line arguments. Reachable over the network with any low-privilege account, a successful attacker can call state-mutating Execution API endpoints as if they were a trusted running task, gaining read and write access to DAG runs, Variables, Connections, and XComs. A patched-image rebuild at version 3.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Airflow API and Kubernetes API server over the network; both surfaces are exposed to authenticated users with cluster access.

• AuthenticationRequired

  Any low-privilege Airflow account combined with Kubernetes read-only access (pods/get in the Airflow namespace) is sufficient; no admin credentials are needed.

• Victim interactionNot required

  No victim action is required; the attacker reads static pod spec output and calls API endpoints directly.

• Attack complexityDetail

  The exploit is reliable and condition-free: the JWT is present in plain text in kubectl describe pod output whenever the KubernetesExecutor is in use.

Blast Radius

• Reads sensitive Airflow Variables and Connections, which commonly store database credentials, API keys, and cloud provider secrets.
• Reads and writes XCom values, allowing manipulation of data passed between tasks in running or future DAG runs.
• Triggers new DAG runs or clears existing runs, causing unintended pipeline executions or data reprocessing.
• Operates with full task-level API authority for the duration the harvested JWT remains valid, without any further escalation needed.