Cyber Posture

CVE-2026-27173

High

Published: 19 May 2026

Published
19 May 2026
Modified
19 May 2026
KEV Added
Patch
CVSS Score 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS Score 0.0001 1.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27173 is a high-severity Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) vulnerability in Apache (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-538

Pre- and post-publication reviews prevent insertion of sensitive information into externally-accessible public locations.

addresses: CWE-538

Monitors for sensitive information placed in externally accessible files or directories.

addresses: CWE-538

The map shows if data actions result in sensitive information being placed in externally accessible locations.

addresses: CWE-538

Isolation and eradication reduce the ability to exploit sensitive information inserted into externally-accessible files or directories.

addresses: CWE-538

Approved categorization forces identification of externally accessible files that contain sensitive content so they receive proper protection.

addresses: CWE-538

The pre-implementation review identifies externally accessible files or directories containing PII and drives access restrictions or removal.

addresses: CWE-538

Tainting makes it possible to determine when sensitive data has been removed from externally accessible files or directories.

addresses: CWE-538

OPSEC practices stop placement of supply-chain information into locations accessible to external parties.

NVD Description

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running…

more

tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)

Affected Products

Apache
inferred from references and description; NVD did not file a CPE for this CVE

References