Apache · Airflow's Experimental API
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
What it is
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
CISA: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 18, 2022
- Added to the CISA list
- January 18, 2022
- Published
- November 10, 2020
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.8% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-1188 CWE-306
- More details
- NVD · CVE.org · CISA
All references (3)
More exploited flaws from Apache
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 8, 2026 | Command Injection | Struts | High 8.1 | 97% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Tomcat | High 7.5 | 99% |
| Apr 16, 2026 | Improper Input Validation | ActiveMQ | High 8.8 | 98% |
| May 1, 2025 | Improper Escaping of Output | HTTP Server | Critical 9.1 | >99.9% |
| Apr 1, 2025 | Path Equivalence | Tomcat | Critical 10.0 | 99.9% |
| Feb 4, 2025 | Forced Browsing | OFBiz | Critical 9.8 | >99.9% |
| Sep 18, 2024 | Improper Access Control | HugeGraph-Server | Critical 9.8 | 99.2% |
| Aug 27, 2024 | Incorrect Authorization | OFBiz | High 8.1 | 99.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.