CVE-2017-15720

8.8 highEPSS 2.5%

High (8.8) in apache airflow. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in apache-airflow 1.9.0.

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.

Severity

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2019-01-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-8fg4-j562-mjrc	PyPI	apache-airflow	<1.9.0	1.9.0
PYSEC-2019-147	PyPI	apache-airflow	<1.9.0	1.9.0