Airflow Kafka provider: connection editor gains code execution inside the scheduler process

Impact

A user whose only privilege is editing Airflow connections can put a dotted Python path into a Kafka connection's extra field; the provider resolves it with import_string and the confluent-kafka client calls it. When the Kafka event producer is enabled (dag_run_events_enabled or task_instance_events_enabled), that client is built inside the scheduler, so the code runs in the control plane rather than on a worker - a privilege boundary Airflow's own security model says should hold. On a GPU fleet the Airflow scheduler is the component that decides what runs on which accelerator node and normally holds the credentials for the whole pipeline estate, so this converts a low-privilege pipeline editor into control of job submission and of any secret the scheduler can read. Google Managed Kafka deployments are not affected because that path overwrites the user-supplied oauth_cb; plain brokers and Amazon MSK are exposed.

Who can reach it

Authenticated Airflow user with permission to edit connections, reachable over the Airflow web UI or API. No further privilege needed. Only deployments that turned on the Kafka event producer are affected; both flags are off by default.

What to do

Upgrade apache-airflow-providers-apache-kafka to 2.0.0 or later, which adds an allowlist configuration option for connection-string callbacks, then restart the scheduler and any process that builds the producer. Until then, disable dag_run_events_enabled and task_instance_events_enabled and cut the set of users who can edit connections. This is a Python package upgrade plus a scheduler restart - no node drain.

References

Related entries

• Jenkins Script Security Plugin: four Groovy sandbox escapes give code execution on the controllerCVE-2026-92122 · Jenkins Script Security Plugin (Groovy sandbox)High
• Jenkins Robot Framework Plugin: archive path escapes the build directory, allowing arbitrary file writeCVE-2026-92137 · Jenkins Robot Framework Plugin (report archive directory)High
• KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High
• KubeEdge (NodeUpgradeJob handler, v1alpha2 API): REMOTE CODE EXECUTION ON EDGE NODES through the upgrade path. TheNCVD-2026-052-kubeedge-nodeupgradejob-handler · KubeEdge (NodeUpgradeJob handler, v1alpha2 API)High
• APC Network Management Card 4 (NMC4): An unauthenticated attacker can manipulate URL parameters to walk out of the webCVE-2024-58310 · APC Network Management Card 4 (NMC4)High
• Cisco Nexus Dashboard Fabric Controller (SSH host key validation): NDFC does not validate the SSH host keysCVE-2025-20163 · Cisco Nexus Dashboard Fabric Controller (SSH host key validation)High