CVE-2020-11978
Apache Airflow Command Injection
Description
CVE-2020-11978 is a high-severity OS command injection vulnerability in Apache Airflow versions 1.10.10 and below. A remote code/command injection flaw was discovered in one of the example DAGs shipped with Apache Airflow, allowing any authenticated user to run arbitrary commands as the user running the Airflow worker or scheduler process. This command injection vulnerability in Apache Airflow is particularly dangerous because it exploits default example DAGs that many installations leave enabled. CISA has added CVE-2020-11978 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.17% (99.91st percentile), active exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | airflow | < 1.10.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E(Mailing List, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11978(Third Party Advisory, US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In the context of CVE-2020-11978, Apache Airflow’s example DAGs fail to properly neutralize user-supplied input before passing it to operating system commands. This OS command injection weakness allows authenticated users to inject shell metacharacters into DAG parameters, resulting in arbitrary command execution on the underlying system with the privileges of the Airflow worker or scheduler process.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2020-11978 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a serious security threat. The vulnerability is remotely exploitable over the network with low attack complexity, requiring only low-level authentication and no user interaction. Confidentiality (High): attackers can read sensitive data accessible to the Airflow process, including credentials, configuration files, and pipeline data. Integrity (High): attackers can modify workflows, inject malicious code into data pipelines, and alter system configurations. Availability (High): attackers can disrupt Airflow operations, terminate processes, or consume system resources. The EPSS score of 94.17% places this vulnerability in the 99.91st percentile, indicating near-certain exploitation activity. Organizations using Apache Airflow with example DAGs enabled face critical risk of complete system compromise.
Exploit Maturity
CVE-2020-11978 has a mature and well-documented exploit landscape. Public exploit code is available via Packet Storm Security and a second exploit variant, both tagged as exploits in the NVD references. CISA has confirmed active exploitation in the wild through its KEV catalog listing, with a remediation deadline of 2022-07-18. The EPSS score of 94.17% (99.91st percentile) indicates near-certain exploitation activity, making immediate remediation critical. This vulnerability is frequently chained with CVE-2020-13927, an authentication bypass in Apache Airflow’s Experimental API, which allows unauthenticated attackers to trigger the command injection remotely.
Remediation
- Upgrade Apache Airflow immediately to version 1.10.11 or later as required by CISA KEV. This is the most effective remediation for CVE-2020-11978.
- Disable example DAGs by setting
load_examples=Falsein your Airflow configuration file (airflow.cfg). If you cannot upgrade immediately, this configuration change alone mitigates the vulnerability. - Restrict network access to Airflow’s web interface and API endpoints using firewall rules, VPN requirements, or network segmentation to limit exposure to trusted networks only.
- Review Airflow process privileges and ensure the worker and scheduler processes run with minimal necessary permissions, following the principle of least privilege to limit the impact of command injection.
- Monitor system logs for indicators of compromise, including unexpected command execution, unusual process spawning by the Airflow user, and suspicious DAG trigger activity. Implement alerting for anomalous behavior in your Airflow deployment.
Technical Details
CVE-2020-11978 is rooted in CWE-78 (OS Command Injection), where one of the example DAGs shipped with Apache Airflow versions 1.10.10 and below constructs OS commands using user-controllable input without proper sanitization. An authenticated user can inject shell metacharacters into DAG parameters, which are then passed to the operating system shell for execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects that the attack is network-based with low complexity, requiring only basic authentication. The injected commands execute with the same privileges as the Airflow worker or scheduler process, which often has broad access to the data pipeline infrastructure, databases, and cloud credentials. The vulnerability only affects installations where example DAGs are loaded (the default behavior), making the mitigation of setting load_examples=False an effective short-term fix.
Frequently Asked Questions
Is CVE-2020-11978 being actively exploited?
Yes. CVE-2020-11978 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.17% (99.91st percentile) indicates near-certain exploitation. Multiple public exploit scripts are available, lowering the barrier for attackers.
What products are affected by CVE-2020-11978?
CVE-2020-11978 affects Apache Airflow versions prior to 1.10.11. The vulnerability is only exploitable when example DAGs are loaded, which is the default configuration. Installations that have set load_examples=False in their Airflow configuration are not vulnerable.
How do I fix CVE-2020-11978?
Upgrade Apache Airflow to version 1.10.11 or later. As an immediate mitigation, disable example DAGs by setting load_examples=False in your Airflow configuration. Additionally, restrict network access to the Airflow web interface and review process privileges to minimize potential impact.
How severe is CVE-2020-11978?
CVE-2020-11978 has a CVSS 3.1 score of 8.8 (HIGH) and an EPSS score in the 99.91st percentile, indicating near-certain exploitation. The vulnerability allows authenticated attackers to execute arbitrary OS commands, potentially leading to complete system compromise of the Airflow infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.