PyPI/apache-airflow-providers-cncf-kubernetes CVE-2023-51702: medium 6.5, EPSS 0.39%

Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Action: Upgrade apache-airflow-providers-cncf-kubernetes to 7.0.0 or later.

pip install apache-airflow-providers-cncf-kubernetes==7.0.0

Affected

Fixed versions

Sources

• osv: GHSA-mg2x-mggj-6955#PyPI/apache-airflow-providers-cncf-kubernetes
• https://nvd.nist.gov/vuln/detail/CVE-2023-51702
• https://github.com/apache/airflow/pull/29498
• https://github.com/apache/airflow/pull/30110
• https://github.com/apache/airflow/pull/36492
• https://github.com/apache/airflow
• https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9
• http://www.openwall.com/lists/oss-security/2024/01/24/3

CVE-2023-51702 · published 2024-01-24T15:30:30Z · modified 2026-07-13T16:43:12.284175149Z · JSON