CVE-2017-15720: Remote Code Execution in Apache Airflow
Summary
CVE-2017-15720: Improper Input Validation in Apache Airflow resulting in Remote Code Execution. Affects apache-airflow versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure. Airflow provides a web-based UI for managing and monitoring workflows. The vulnerability identified as CVE-2017-15720 allows an authenticated user to execute code remotely on the Airflow webserver by creating a specially crafted object.
Vulnerability Detail
The vulnerability arises due to improper input validation in Apache Airflow versions 1.8.2 and earlier. An authenticated user can exploit this vulnerability by creating a specific object, which triggers remote code execution on the Airflow webserver. This can lead to unauthorized access, data breaches, and potential compromise of the entire Airflow infrastructure. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of remote code execution.
Conclusion
The vulnerability in Apache Airflow (CVE-2017-15720) allows authenticated users to execute code remotely on the Airflow webserver. To mitigate this risk, it is crucial to upgrade to Apache Airflow version 1.9.0 or later. This upgrade ensures that the vulnerability is patched and the system is secure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform for programmatically authoring, scheduling, and monitoring workflows.
The vulnerability allows an authenticated user to execute code remotely on the Airflow webserver, potentially leading to unauthorized access and data breaches.
To fix this vulnerability, upgrade to Apache Airflow version 1.9.0 or later.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
