CVE-2026-27173
Published: 19 May 2026
Summary
CVE-2026-27173 is a high-severity Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) vulnerability in Apache Airflow Cncf Kubernetes. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Application Access Token (T1528); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30977
Vulnerability details
JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running…
more
tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
JWT token exposure directly enables token theft (T1528) and subsequent use as alternate auth material (T1550.001) for unauthorized task actions.
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Pre- and post-publication reviews prevent insertion of sensitive information into externally-accessible public locations.
Monitors for sensitive information placed in externally accessible files or directories.
The map shows if data actions result in sensitive information being placed in externally accessible locations.
Isolation and eradication reduce the ability to exploit sensitive information inserted into externally-accessible files or directories.
Approved categorization forces identification of externally accessible files that contain sensitive content so they receive proper protection.
The pre-implementation review identifies externally accessible files or directories containing PII and drives access restrictions or removal.
Tainting makes it possible to determine when sensitive data has been removed from externally accessible files or directories.
OPSEC practices stop placement of supply-chain information into locations accessible to external parties.