Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integration
Summary: Unit 42 researchers found vulnerabilities in the Azure Data Factory Apache Airflow integration that let an attacker who gains write access to a DAG file or a compromised service principal obtain cluster admin rights over the Airflow AKS cluster. The managed Airflow instance used default, non-changeable configurations and attached the cluster admin role to the Airflow runner, and Microsoft classified the issues as low severity while stating the impact was isolated to the researcher's cluster.
What you should know: A service account token mounted into an Airflow pod carried cluster admin permissions, giving full control of the cluster and a path to the host VM, managed identities, and Azure's internal Geneva service that manages logs and metrics. Microsoft's low-severity rating rests on the cluster being isolated, so the question for your own deployment is whether that same default, non-changeable configuration and admin-attached runner exist in yours.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026