Scheduler RCE in Apache Airflow Kafka Provider via Unrestricted Callback Import
The Apache Kafka provider for Apache Airflow (versions 1.15.0 before 2.0.0) resolves dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string` with no allowlist, and hands them to the confluent-kafka client, which invokes them. An attacker whose only privilege is editing Airflow connections can plant such a callback, and when the Kafka event producer is enabled (dag_run_events_enabled or task_instance_events_enabled, both disabled by default), the client is constructed inside the scheduler process so the attacker's code runs there. This grants arbitrary code execution in the Airflow control plane, exceeding the intended security model in which connection-configuration users are limited to code execution on workers only. Deployments using Google Managed Kafka are unaffected because that code path overwrites any user-supplied oauth_cb, while plain Kafka brokers and Amazon MSK are exposed. No public proof-of-concept or in-the-wild exploitation is known, and the flaw has not been added to CISA KEV.
What to do: Upgrade apache-airflow-providers-apache-kafka to 2.0.0 or later and configure the new allowlist option for connection-string callbacks. Until patched, restrict connection-editing privileges to trusted users and audit existing Kafka connections' `extra` fields for unexpected dotted-path callback entries. Deployments that have not enabled dag_run_events_enabled or task_instance_events_enabled, or that use Google Managed Kafka, are not exposed.
| Product | Affected |
|---|---|
| apache-airflow-providers-apache-kafka | >= 1.15.0 and < 2.0.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafka event producer — `dag_run_events_enabled` or `task_instance_events_enabled`, both disabled by default — build that client inside the scheduler process, so a user whose only privilege is editing Airflow connections gains arbitrary code execution in the control plane; the Airflow security model limits connection-configuration users to code execution on workers, not the scheduler. Deployments using Google Managed Kafka are not affected, because that code path overwrites any user-supplied `oauth_cb`; plain brokers and Amazon MSK are exposed. Users are recommended to upgrade to apache-airflow-providers-apache-kafka 2.0.0 or later, which adds an allowlist configuration option for connection-string callbacks.
Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views