CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Airflow's Experimental API, fix it now.
CISA required action: Apply updates per vendor instructions.
US federal civilian agencies must remediate by Jul 18, 2022.
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.
Description
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Affected products
| Product | Vendor | Affected versions | Fixed in | Source |
|---|---|---|---|---|
| Airflow | Apache Software Foundation | < 1.10.11 | 1.10.11 | NVD |
| Airflow's Experimental API | Apache Software Foundation | — | — | KEV |
Sources: NVD = NIST National Vulnerability Database; KEV = CISA Known Exploited Vulnerabilities catalog.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdateKEV
CVE-2020-13927 scored CVSS 9.8: Apache Airflow's Experimental API, Apache Airflow's Experimental API Authentication Bypass
CISA lists this as exploited in the wild. Unpatched Airflow's Experimental API systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
1 earlier event is available with a subscription. See plans.
Coverage
We have not published a story about this vulnerability yet.