CVE-2020-13927: Vulnerability in apache-airflow
Summary
CVE-2020-13927: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. Affects apache-airflow versions < 1.10.11. Fixed in 1.10.11. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-13927 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) of tasks. The Experimental API in Airflow, prior to version 1.10.11, had a default setting that allowed all API requests without authentication. This posed security risks to users who were unaware of this fact.
Vulnerability Detail
The vulnerability (CVE-2020-13927) in Apache Airflow's Experimental API allowed unauthorized access to API requests, potentially exposing sensitive information and allowing malicious actors to execute arbitrary code. This vulnerability could lead to unauthorized data access, privilege escalation, and remote code execution. It affected all versions of Apache Airflow prior to 1.10.11.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.11
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users must update their configuration as mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The vulnerability (CVE-2020-13927) in Apache Airflow's Experimental API allowed unauthorized access to API requests, potentially leading to unauthorized data access, privilege escalation, and remote code execution. Users of Apache Airflow should update their configuration to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows.
The Experimental API in Apache Airflow allows users to interact with Airflow programmatically through API requests.
The previous default setting allowed all API requests without authentication, posing security risks.
The vulnerability could lead to unauthorized data access, privilege escalation, and remote code execution.
To fix this vulnerability, update your configuration file to set [api]auth_backend = airflow.api.auth.backend.deny_all.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
