CVE-2026-27173
Published: 19 May 2026
Summary
CVE-2026-27173 is a high-severity Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) vulnerability in Apache (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Pre- and post-publication reviews prevent insertion of sensitive information into externally-accessible public locations.
Monitors for sensitive information placed in externally accessible files or directories.
The map shows if data actions result in sensitive information being placed in externally accessible locations.
Isolation and eradication reduce the ability to exploit sensitive information inserted into externally-accessible files or directories.
Approved categorization forces identification of externally accessible files that contain sensitive content so they receive proper protection.
The pre-implementation review identifies externally accessible files or directories containing PII and drives access restrictions or removal.
Tainting makes it possible to determine when sensitive data has been removed from externally accessible files or directories.
OPSEC practices stop placement of supply-chain information into locations accessible to external parties.
NVD Description
JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running…
more
tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)