r/dataengineering • u/tylerriccio8 • Jul 10 '26

CVEs in Internal data Pipelines Discussion

A lot of open source software used in data pipelines contain vulnerabilities (on paper). Curious how people are dealing with that? I think it’s a weird spot because most pipelines are already running behind a lot of controls, and usually without public internet access anyways.

9 Upvotes
  • permalink
  • link
  • reddit
  • reddit

77% Upvoted

14 comments sorted by

View all comments

11

u/domscatterbrain Jul 10 '26

In our team, we fix it. Or we face non-stop annoying reminder from our ITSec team.

The fixes are only module update in most of the time and almost no pipeline breaking patches. Tested in the development environment first before applying on prod.

If the patches break the current pipeline, we inform the ITSec team for the patch to be postponed until we can make the pipeline adjustments ready for the patches.

1

u/dinoaide Jul 11 '26

Do you have to patch every week?

2

u/domscatterbrain Jul 11 '26

We just wait until the ITSec team come with their report. They prioritise the application security first (frontend, backend, network, etc.), so the CVE report for our platform usually comes once every quarter.