CVE-2020-11983: Stored XSS vulnerability in Apache Airflow
Summary
CVE-2020-11983: An issue was found in Apache Airflow versions 1.10.10 and below. Affects apache-airflow versions < 1.10.11rc1. Fixed in 1.10.11rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-11983 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It provides a rich set of tools and features for managing and monitoring data pipelines. The vulnerability identified as CVE-2020-11983 affects Apache Airflow versions 1.10.10 and below. This vulnerability allows authenticated users with appropriate permissions to create stored cross-site scripting (XSS) attacks. XSS attacks can lead to the execution of malicious scripts in the context of the affected user's browser, potentially compromising sensitive information or enabling further attacks.
Vulnerability Detail
The vulnerability arises from incorrect handling of escaping in the admin management screens of the new/RBAC UI in Apache Airflow. This flaw allows authenticated users to inject malicious scripts into the application, which are then executed when other users access the affected pages. This can lead to various consequences, such as stealing session cookies, redirecting users to malicious websites, or performing actions on behalf of the user without their consent. The impact of this vulnerability depends on the permissions of the authenticated user and the sensitivity of the data accessible through the affected pages.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.11rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected admin management screens or restrict access to them for authenticated users until the upgrade to a fixed version can be performed. This can be achieved by modifying the application's configuration or access control settings. However, it is crucial to apply the official fix as soon as possible to ensure complete protection against the vulnerability.
Conclusion
The stored XSS vulnerability in Apache Airflow versions 1.10.10 and below can be exploited by authenticated users with appropriate permissions to inject and execute malicious scripts. This can lead to various security risks, including data theft and unauthorized actions. To mitigate this vulnerability, it is crucial to upgrade to Apache Airflow version 1.10.11rc1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It provides a rich set of tools and features for managing and monitoring data pipelines.
Stored cross-site scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious scripts into a website or application. These scripts are then executed when other users access the affected pages, potentially compromising their data or enabling further attacks.
Authenticated users with appropriate permissions can exploit this vulnerability by injecting malicious scripts into the admin management screens of the new/RBAC UI in Apache Airflow. These scripts are then executed when other users access the affected pages, potentially leading to various consequences such as data theft or unauthorized actions.
The impact of this vulnerability depends on the permissions of the authenticated user and the sensitivity of the data accessible through the affected pages. It can range from stealing session cookies and redirecting users to malicious websites to performing actions on behalf of the user without their consent.
To protect your Apache Airflow installation, it is recommended to upgrade to version 1.10.11rc1 or later, which includes the fix for this vulnerability. Additionally, it is important to follow security best practices such as regularly updating the software, implementing strong access controls, and monitoring for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
