A flaw in the Apache Airflow Apache Kafka provider allows a user with permission to edit Airflow connections to resolve dotted‑path strings in a Kafka connection’s ‘extra’ field into Python callables via import_string, without an allowlist. The resulting callables are passed to the confluent‑kafka client library, which executes them in the scheduler process. The flaw enables arbitrary code execution in the Airflow control plane, a privilege that normally belongs only to downstream workers.

The vulnerability affects Apache Airflow Apache Kafka provider versions 1.15.0 through 1.15.x, and all earlier releases up to but not including 2.0.0. Deployments that enable the Kafka event producer (dag_run_events_enabled or task_instance_events_enabled) are at risk; these options are disabled by default. Plain Kafka brokers and Amazon Managed Streaming for Kafka are exposed. The issue is not relevant for Google Managed Kafka, which overrides user supplied callbacks.

The vulnerability provides a high‑severity attack surface: a malicious actor who can edit connection configurations can run arbitrary code on the scheduler. Because no CVSS score is supplied and EPSS is not available, the exploitability is inferred to be high but the exact probability is unknown. The weakness is classified as CWE‑470 (Use of Hard-coded Buffer or Resource). The attack vector is likely based on privileged connection management in Airflow. The vulnerability is not listed in CISA KEV. The available fix is a software update to provider 2.0.0 or later, which introduces an allowlist for callbacks.