CVE-2017-15720 Improper Input Validation in Apache Airflow resulting in Remote Code Execution
Authenticated users can execute arbitrary code on the Apache Airflow webserver by creating a specially crafted object.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15720?
CVE-2017-15720 is a high-severity code injection vulnerability in Apache Airflow, published on 23 Jan 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
Weakness: CWE-20
Which versions are affected by CVE-2017-15720?
3 open source packages ship an affected version, including apache-airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | All versions | 1.9.0 |
apache-airflow PyPI | All versions | 1.9.0 |
apache-airflow PyPI | All versions | 1.9.0 |
Products include Apache Airflow.
How do I fix CVE-2017-15720?
Upgrade apache-airflow to 1.9.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-15720 being exploited?
There is no known exploitation of CVE-2017-15720 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Sources
Also known as GHSA-8fg4-j562-mjrc, PYSEC-2019-147.