CVE-2020-17515: XSS Vulnerability in Apache Airflow
Summary
CVE-2020-17515: The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. Affects apache-airflow versions < 1.10.13. Fixed in 1.10.13. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2020-17515 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of tools and features for managing complex data pipelines. However, versions prior to 1.10.13 are vulnerable to a cross-site scripting (XSS) exploit. This vulnerability allows an attacker to inject malicious scripts into the 'origin' parameter of certain endpoints, such as '/trigger'.
Vulnerability Detail
The 'origin' parameter in Apache Airflow was not properly sanitized, making it susceptible to XSS attacks. An attacker could craft a malicious payload and inject it into the 'origin' parameter, which would then be executed by the victim's browser. This could lead to various consequences, including unauthorized access, data theft, and the execution of arbitrary code on the victim's system. Although a fix was implemented in Airflow 1.10.13, it was not completely effective in resolving the issue.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.13
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the 'origin' parameter before passing it to the affected endpoints. This can be done by implementing input validation and sanitization techniques, such as HTML entity encoding or using a dedicated library for XSS prevention.
Conclusion
The XSS vulnerability in Apache Airflow versions prior to 1.10.13 can be mitigated by upgrading to the latest version or implementing proper input validation and sanitization techniques. It is crucial to promptly address this vulnerability to prevent potential attacks and protect sensitive data. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform for managing and orchestrating workflows. It allows users to define, schedule, and monitor complex data pipelines.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, and defacement of websites.
This vulnerability allows attackers to execute arbitrary scripts in the context of a victim's browser, potentially leading to unauthorized access, data theft, and the execution of malicious code.
Yes, a fix has been implemented in Apache Airflow version 1.10.13. It addresses the XSS vulnerability by properly sanitizing the 'origin' parameter.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the 'origin' parameter before passing it to the affected endpoints.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
