CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
Apache Airflow's Experimental API allowed unauthenticated access by default, enabling attackers to read or modify data without credentials.
- Exploited in the wild
- Since 18 Jan 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13927?
CVE-2020-13927 is a critical missing authorization vulnerability in Apache Airflow, published on 10 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
Which versions are affected by CVE-2020-13927?
4 open source packages ship an affected version, including apache-airflow and airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | All versions | 1.10.11 |
apache-airflow PyPI | All versions | 1.10.11 |
apache-airflow PyPI | All versions | 1.10.11 |
airflow Bitnami | All versions | 1.10.11 |
Products include Apache Airflow.
How do I fix CVE-2020-13927?
Upgrade apache-airflow to 1.10.11 or later. US federal agencies must fix it by 18 Jul 2022.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-13927 being exploited?
Yes. Attackers have exploited CVE-2020-13927 in the wild since at least 18 Jan 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Airflow
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
- CVE-2022-38649 Apache Airflow Pinot provider allowed Command Injection
Sources
Also known as BIT-airflow-2020-13927, GHSA-hhx9-p69v-cx2j, PYSEC-2020-18.