CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Airflow Experimental API Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2020-13927)
[Affected Scope] Apache Airflow versions prior to 1.10.11, and existing installations retaining default configurations
[Impact] Unauthenticated attackers can access the Experimental API to trigger arbitrary DAGs, leading to full remote code execution (RCE) and server compromise
[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or explicitly configure the API authentication backend to 'deny_all' in airflow.cfg
Apache Airflow Example DAG Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2020-11978)
[Affected Scope] Apache Airflow versions 1.10.10 and below with example DAGs enabled (load_examples=True)
[Impact] Authenticated attackers can execute arbitrary OS commands with the privileges of the Airflow worker/scheduler by injecting malicious payloads into example DAG parameters
[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or disable example DAGs by setting load_examples=False in airflow.cfg