CVE-2020-11978: Remote Code/Command Injection in Apache Airflow
Summary
CVE-2020-11978: An issue was found in Apache Airflow versions 1.10.10 and below. Affects apache-airflow versions < 1.10.11rc1. Fixed in 1.10.11rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-11978 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure. Airflow supports various executors, such as LocalExecutor and CeleryExecutor, to execute tasks in parallel. The vulnerability identified in Apache Airflow versions 1.10.10 and below allows authenticated users to execute arbitrary commands on the system running the airflow worker/scheduler, depending on the executor in use.
Vulnerability Detail
The vulnerability arises from a remote code/command injection flaw present in one of the example DAGs shipped with Apache Airflow. This flaw enables authenticated users to execute arbitrary commands within the context of the user running the airflow worker/scheduler. The impact of this vulnerability can be severe, as it allows an attacker to execute unauthorized commands, potentially leading to unauthorized data access, privilege escalation, or even complete compromise of the affected system. It is important to note that if the example DAGs are disabled by setting 'load_examples=False' in the configuration, the vulnerability is not exploitable.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.11rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can mitigate the vulnerability by disabling the example DAGs. This can be achieved by setting 'load_examples=False' in the Apache Airflow configuration file. By doing so, the vulnerable example DAGs will not be loaded, eliminating the risk of exploitation.
Conclusion
The remote code/command injection vulnerability in Apache Airflow versions 1.10.10 and below poses a significant risk to systems running the airflow worker/scheduler. It is crucial to upgrade to Apache Airflow version 1.10.11rc1 or later to mitigate this vulnerability. Alternatively, disabling the example DAGs by setting 'load_examples=False' can provide temporary protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows.
A Directed Acyclic Graph (DAG) is a finite directed graph with no directed cycles. In Apache Airflow, DAGs are used to define and represent workflows.
The vulnerability allows authenticated users to execute arbitrary commands on the system running the airflow worker/scheduler, potentially leading to unauthorized data access, privilege escalation, or complete compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 1.10.11rc1 or later. Alternatively, you can disable the example DAGs by setting 'load_examples=False' in the Apache Airflow configuration file.
No, if the example DAGs are disabled by setting 'load_examples=False' in the Apache Airflow configuration, the vulnerability is not exploitable.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
