Skip to content
fr Sign in
9.8 Critical Exploited

CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass

Active exploitation observed

· CISA KEV catalogue
Required action Apply updates per vendor instructions.
Ransomware campaigns Not observed so far
Weakness CWE-306, CWE-1188

Description

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default

Affected products and versions

Product Affected versions Fixed in
Apache Airflow Versions not published
Airflow 1.10 earliest → < 1.10.11 1.10.11

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of Apache Airflow

The 5 CVEs of Apache Airflow →
CVE-2020-13944 In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to… Not rated CVE-2019-12417 A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary… Not rated CVE-2019-0216 A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary… Not rated CVE-2019-0229 A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were… Not rated
Track this CVE