CVE-2020-11983: Stored XSS in RBAC Admin screens in Apache Airflow
Summary
CVE-2020-11983: Multiple stored XSS in RBAC Admin screens in Apache Airflow. Affects apache-airflow versions < 1.10.11. Fixed in 1.10.11. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-11983 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating complex data pipelines. The RBAC (Role-Based Access Control) UI is a new feature introduced in Apache Airflow to enhance user management and permissions. This vulnerability affects Apache Airflow versions 1.10.10 and below.
Vulnerability Detail
The RBAC Admin screens in Apache Airflow's new UI incorrectly handle escaping, leading to multiple instances of stored cross-site scripting (XSS) vulnerabilities. Authenticated users with appropriate permissions can exploit this vulnerability to inject malicious scripts into the admin management screens. These scripts will then be executed when other users, including administrators, access these screens, potentially leading to unauthorized actions, data theft, or further compromise of the system. The vulnerability has a CVSS score of 5.4, indicating a moderate severity.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the RBAC Admin screens or restrict access to them. This can be achieved by modifying the configuration or access control settings of Apache Airflow. However, it is strongly advised to apply the official fix by upgrading to a patched version.
Conclusion
Apache Airflow versions 1.10.10 and below are affected by a stored XSS vulnerability in the RBAC Admin screens. This vulnerability allows authenticated users to inject malicious scripts, potentially leading to unauthorized actions or data theft. It is recommended to upgrade to Apache Airflow version 1.10.11 or above to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform for managing and orchestrating data workflows.
RBAC stands for Role-Based Access Control. It is a method of managing user permissions based on their assigned roles.
This vulnerability allows authenticated users with appropriate permissions to execute malicious scripts on the RBAC Admin screens, potentially leading to unauthorized actions or data theft.
The vulnerability has a CVSS score of 5.4, indicating a moderate severity.
To fix this vulnerability, upgrade to Apache Airflow version 1.10.11 or above.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
