CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
Description
CVE-2020-13927 is a critical-severity authentication bypass vulnerability in Apache Airflow’s Experimental API. The previous default setting for Apache Airflow’s Experimental API allowed all API requests without any authentication, exposing critical functionality to unauthenticated attackers. This missing authentication vulnerability in Apache Airflow carries a CVSS score of 9.8, as it enables remote attackers to interact with the Airflow API without credentials, potentially triggering DAG executions and manipulating workflows. CISA has included CVE-2020-13927 in its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.86% (99.87th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | airflow | < 1.10.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E(Mailing List, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13927(Third Party Advisory, US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
In the context of CVE-2020-13927, Apache Airflow’s Experimental API was configured by default to allow all requests without any authentication mechanism. This missing authentication weakness exposed critical API functions—including DAG triggering and task management—to unauthenticated users, enabling complete unauthorized access to Airflow’s control plane.
Learn more: CWE-306 — Missing Authentication for Critical Function
CWE-1188: Initialization of a Resource with an Insecure Default
The root cause of CVE-2020-13927 is an insecure default configuration in Apache Airflow. The Experimental API’s default authentication backend was set to allow all requests, assuming administrators would change this setting during deployment. This insecure default left many installations exposed because administrators were unaware that explicit configuration changes were necessary to secure the API.
Learn more: CWE-1188 — Initialization of a Resource with an Insecure Default
Impact Analysis
CVE-2020-13927 has a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest tier of vulnerability severity. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction—the worst-case scenario for exploitability. Confidentiality (High): unauthenticated attackers can access sensitive API data including DAG configurations, connection details, and variable values that may contain credentials. Integrity (High): attackers can trigger arbitrary DAG executions, modify workflows, and manipulate task states without authorization. Availability (High): attackers can disrupt Airflow operations by pausing DAGs, killing tasks, or overloading the scheduler. The EPSS score of 93.86% (99.87th percentile) confirms near-certain exploitation, making this one of the most actively targeted Apache Airflow vulnerabilities.
Exploit Maturity
CVE-2020-13927 has a highly mature exploit landscape. Public exploit code is available via Packet Storm Security and a second variant, which demonstrate how the authentication bypass can be leveraged for remote code execution. CISA has confirmed active exploitation in the wild through its KEV catalog listing, with a remediation deadline of 2022-07-18. The EPSS score of 93.86% (99.87th percentile) indicates near-certain exploitation activity. This vulnerability is commonly chained with CVE-2020-11978 (command injection in example DAGs), where CVE-2020-13927 provides the unauthenticated access and CVE-2020-11978 delivers the code execution, creating a fully unauthenticated remote code execution chain.
Remediation
- Upgrade Apache Airflow to version 1.10.11 or later as required by CISA KEV. Starting from version 1.10.11, the default API authentication backend is changed to deny all requests.
- For existing installations, explicitly set the API authentication backend to deny all requests by configuring
[api] auth_backend = airflow.api.auth.backend.deny_allin yourairflow.cfgfile, or configure a proper authentication backend such asairflow.api.auth.backend.basic_auth. - Restrict network access to the Airflow web server and API endpoints using firewall rules, reverse proxy authentication, or VPN requirements to ensure only authorized networks can reach the Experimental API.
- Audit API access logs for unauthorized requests to the Experimental API endpoints, particularly DAG trigger operations, task state modifications, and connection/variable reads that may indicate prior exploitation.
- Implement defense-in-depth by applying authentication at the API layer and at the network level, following the principle of never relying solely on application-level security. Review the Airflow security documentation for recommended authentication configurations.
Technical Details
CVE-2020-13927 is fundamentally caused by CWE-306 (Missing Authentication for Critical Function) combined with CWE-1188 (Initialization of a Resource with an Insecure Default). Apache Airflow’s Experimental API, prior to version 1.10.11, shipped with a default authentication backend that permitted all API requests without any credential verification. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum exploitability: network-accessible, low complexity, no privileges required, and no user interaction needed. The API exposed critical operations including DAG management, task execution, and configuration access. The insecure default was particularly dangerous because it relied on administrators proactively changing the configuration—a common anti-pattern that left many production installations exposed. From version 1.10.11, Apache Airflow changed the default to deny_all, but existing installations required manual configuration updates as documented in the project’s upgrade guide.
Frequently Asked Questions
Is CVE-2020-13927 being actively exploited?
Yes. CVE-2020-13927 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.86% (99.87th percentile) indicates near-certain exploitation. This vulnerability is frequently chained with CVE-2020-11978 for complete unauthenticated remote code execution.
What products are affected by CVE-2020-13927?
CVE-2020-13927 affects Apache Airflow versions prior to 1.10.11. Any installation that has not explicitly configured the API authentication backend is vulnerable, as the default setting allowed unauthenticated access to the Experimental API.
How do I fix CVE-2020-13927?
Upgrade Apache Airflow to version 1.10.11 or later. For existing installations, immediately configure [api] auth_backend = airflow.api.auth.backend.deny_all in your airflow.cfg to block unauthenticated API access. Additionally, restrict network access to the Airflow API using firewall rules or a reverse proxy with authentication.
How severe is CVE-2020-13927?
CVE-2020-13927 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier. It requires no authentication, no user interaction, and is remotely exploitable with low complexity. Combined with its near-certain exploitation probability (EPSS 99.87th percentile), this vulnerability demands immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.