CVE-2020-13927criticalunder attackCWE-1056CWE-1188CWE-306

CVE-2020-13927: critical vulnerability in Apache Airflow

Published · Updated

Follow this CVE+ Monitor Apache Airflow+ Monitor Airflow's Experimental API

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon204 days
Published on NVDNov 10
1st PoC+204d
metasploitJul 14
CISA KEV+434d
Action required by CISAfederal deadline: 2022-07-18

Apply updates per vendor instructions.

In short

Apache Airflow's Experimental API was open to all users by default without requiring authentication, allowing anyone with network access to control workflows and data. This was changed in version 1.10.11 to deny all requests by default, but existing installations remain vulnerable unless manually configured.

Technical detail

The Experimental API endpoint lacked authentication enforcement by default (CWE-306), allowing unauthenticated remote attackers to make arbitrary API calls over the network. Exploitation requires only network access to the Airflow instance; the vulnerability affects pre-1.10.11 deployments and those that have not explicitly configured the deny_all auth backend. Impact includes unauthorized workflow manipulation, data exfiltration, and potential remote code execution through DAG uploads.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Apache Airflow
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.