{"cve":"CVE-2020-13927","nvd":{"published":"2020-11-10T16:15:11.807","modified":"2026-06-17T02:53:54.840","status":"Analyzed","description":"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-306","CWE-1188","CWE-1056"],"references":["http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html","http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html","https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E","http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html","http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html"],"products":["apache:airflow"],"source":"nvd","synced_at":"2026-10-19T21:11:20.317016139+00:00"},"epss":{"cve":"CVE-2020-13927","score":0.99778,"percentile":0.99955,"date":"2026-11-01"},"kev":{"cve":"CVE-2020-13927","date_added":"2022-01-18","due_date":"2022-07-18","vendor":"Apache","product":"Airflow's Experimental API","known_ransomware":false},"osv":[{"id":"GHSA-hhx9-p69v-cx2j","url":"https://osv.dev/vulnerability/GHSA-hhx9-p69v-cx2j","summary":"Authentication bypass in Apache Airflow","modified":"2025-10-22T19:42:35.160234Z","packages":[{"ecosystem":"PyPI","name":"apache-airflow","purl":"pkg:pypi/apache-airflow","ranges":["<1.10.11"],"fixed":["1.10.11"]}]},{"id":"PYSEC-2020-18","url":"https://osv.dev/vulnerability/PYSEC-2020-18","summary":"","modified":"2023-12-06T01:00:12.608061Z","packages":[{"ecosystem":"PyPI","name":"apache-airflow","purl":"pkg:pypi/apache-airflow","ranges":["<1.10.11"],"fixed":["1.10.11"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}