cbcvebase.

Apache Software Foundation Apache Airflow Apache Kafka Provider vulnerabilities

1 known vulnerability affecting apache_software_foundation/apache_airflow_apache_kafka_provider.

Total CVEs
1
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1

Vulnerabilities

Page 1 of 1
CVE-2026-86792P2HIGHCVSS 8.8≥ 1.15.0, < 2.0.02026-09-16
CVE-2026-86792 [HIGH] CWE-470 CVE-2026-86792: Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafka event producer — `dag_run_events_enabled` or `task
nvd
Apache Software Foundation Apache Airflow Apache Kafka Provider vulnerabilities | cvebase