CVE-2020-13927

CRITICAL KEV NUCLEI

Apache Airflow < 1.10.11 - Missing Authentication

Title source: rule

Description

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default

Exploits (2)

exploitdb WORKING POC

by Pepe Berba · pythonwebappsmultiple

https://www.exploit-db.com/exploits/49927

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by xuxiang, Pepe Berba, Ismail E. Dawoodjee · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_airflow_dag_rce.rb

View Code ZIP pw:eip

Nuclei Templates (1)

Airflow Experimental <1.10.11 - REST API Auth Bypass

CRITICALVERIFIEDby pdteam

Shodan:

title:"Airflow - DAGs" || http.html:"Apache Airflow" || http.title:"airflow - dags" || http.html:"apache airflow" || http.title:"sign in - airflow" || product:"redis"

FOFA: title="sign in - airflow" || apache airflow || title="airflow - dags" || http.html:"apache airflow"

References (4)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html

[Mailing List, Vendor Advisory] https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E

[Third Party Advisory, US Government Resource] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13927

Scores

CVSS v3 9.8

EPSS 0.9410

EPSS Percentile 99.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2022-01-18

VulnCheck KEV 2022-01-18

InTheWild.io 2021-09-17

ENISA EUVD EUVD-2020-0037

CWE

CWE-306 CWE-1188 CWE-1056

Status published

Products (2)

apache/airflow < 1.10.11

pypi/apache-airflow 0 - 1.10.11PyPI

Published Nov 10, 2020

KEV Added Jan 18, 2022

Tracked Since Feb 18, 2026