The vulnerability arises from the Apache Airflow Apache Kafka provider resolving dotted-path strings found in a Kafka connection's extra field into Python callables via import_string without any allowlist. When Kafka event producer features (dag_run_events_enabled or task_instance_events_enabled) are enabled, the confluent-kafka client is instantiated inside the scheduler process, allowing a user with only connection editing privileges to execute arbitrary code in the scheduler. This breaks the intended security model where such code execution should be limited to workers. Google Managed Kafka deployments are not affected due to overwriting of user-supplied oauth_cb. The vulnerability affects versions >=1.15.0 and <2.0.0 and is addressed in version 2.0.0 by introducing an allowlist configuration option.

An attacker with permission to edit Airflow connections can achieve arbitrary code execution in the scheduler process if Kafka event producer features are enabled. This elevates privileges beyond the intended scope, potentially compromising the control plane of Airflow deployments using plain Kafka brokers or Amazon MSK. Deployments using Google Managed Kafka are not vulnerable. This could lead to full compromise of the Airflow scheduler environment.

Users should upgrade to apache-airflow-providers-apache-kafka version 2.0.0 or later, which introduces an allowlist configuration option for connection-string callbacks to prevent unsafe reflection. If upgrading is not immediately possible, disabling the Kafka event producer features (dag_run_events_enabled and task_instance_events_enabled) will mitigate the risk, as these are disabled by default. There is no indication that other mitigations are sufficient or recommended.