CVE-2017-15720: Remote Code Execution in Apache Airflow
Summary
CVE-2017-15720: In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object. Affects apache-airflow versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as directed acyclic graphs (DAGs) of tasks. These tasks can be executed on a variety of platforms, including Hadoop, Kubernetes, and Docker. The vulnerability identified as CVE-2017-15720 affects Apache Airflow versions 1.8.2 and earlier.
Vulnerability Detail
The vulnerability allows an authenticated user to execute code remotely on the Airflow webserver by creating a special object. This object can be manipulated to exploit a code execution vulnerability, potentially leading to unauthorized access, data breaches, or further compromise of the system. The vulnerability was addressed in Apache Airflow version 1.9.0.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the fix by upgrading to a secure version of Apache Airflow.
Conclusion
The vulnerability CVE-2017-15720 in Apache Airflow allows authenticated users to execute code remotely on the Airflow webserver. It is crucial to upgrade to Apache Airflow version 1.9.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows.
The vulnerability allows an authenticated user to execute code remotely on the Airflow webserver, potentially leading to unauthorized access, data breaches, or further compromise of the system.
Apache Airflow versions 1.8.2 and earlier are affected by this vulnerability.
Yes, the vulnerability has been fixed in Apache Airflow version 1.9.0.
To fix the vulnerability, it is recommended to upgrade to Apache Airflow version 1.9.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
