CVE-2020-11982: Apache Airflow Remote Code Execution
Summary
CVE-2020-11982: An issue was found in Apache Airflow versions 1.10.10 and below. Affects apache-airflow versions < 1.10.11rc1. Fixed in 1.10.11rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-11982 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) of tasks. These tasks can be executed on a variety of platforms, including CeleryExecutor which utilizes a message broker such as Redis or RabbitMQ. This vulnerability affects Apache Airflow versions 1.10.10 and below.
Vulnerability Detail
The vulnerability arises when using CeleryExecutor and an attacker gains direct access to the message broker. By inserting a malicious payload into the broker, the attacker can trigger a deserialization attack on the worker, leading to remote code execution. This can have severe consequences, allowing the attacker to execute arbitrary code on the affected system.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.11rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict direct access to the message broker from untrusted sources. This can be achieved by configuring appropriate network access controls or firewall rules to limit access to the broker only from trusted hosts.
Conclusion
Apache Airflow versions 1.10.10 and below are vulnerable to a remote code execution vulnerability when using CeleryExecutor. It is crucial to upgrade to version 1.10.11rc1 or later to mitigate this risk. Restricting access to the message broker can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for authoring, scheduling, and monitoring workflows.
CeleryExecutor is a task execution framework used in Apache Airflow that relies on a message broker for task distribution.
A deserialization attack occurs when an attacker manipulates serialized data to execute arbitrary code during the deserialization process.
This vulnerability can lead to remote code execution, allowing an attacker to execute arbitrary code on the affected system.
The recommended mitigation is to upgrade to Apache Airflow version 1.10.11rc1 or later. Alternatively, restrict direct access to the message broker from untrusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
