Sensitive JWT tokens used by workers in Kubernetes Executors are exposed to users with read-only access to Pods, creating a risk of unauthorized privilege escalation.

Sensitive JWT tokens are improperly stored or exposed within Kubernetes Pods, allowing authenticated users with limited read-only permissions to access credentials used by executors.

Exposure of JWT tokens allows an attacker to impersonate worker accounts, potentially gaining elevated access or executing unauthorized operations within the Airflow environment. With a CVSS score of 8.7, this vulnerability presents a high risk to the overall security and integrity of the orchestration platform.

Immediate Action: Update the apache-airflow-providers-cncf-kubernetes package to version 10.17.0 or later.

Proactive Monitoring: Audit Kubernetes RBAC policies and review access logs for accounts that have recently accessed Pod configurations to identify potential credential abuse.

Compensating Controls: Rotate all potentially exposed JWT tokens immediately following the update to ensure that any previously compromised credentials are invalidated.

Public Exploit Available: No — there is no confirmed public weaponized exploit available at this time.

This vulnerability requires urgent attention, especially in multi-tenant or shared-access Kubernetes environments. Organizations should prioritize updating the affected provider package and rotating any sensitive tokens that may have been exposed to unauthorized users.