CVE-2020-11978

CVE-2020-11978 is an OS command injection flaw (CWE-78) in the example DAGs shipped by default with Apache Airflow 1.10.10 and earlier. Any authenticated user can trigger one of these bundled example DAGs and inject arbitrary shell commands, which execute under the account running the Airflow worker or scheduler depending on the executor in use. Successful exploitation gives an attacker remote code execution with those privileges on the workflow infrastructure. Only deployments running Airflow 1.10.10 or below that load the default example DAGs (i.e., load_examples is not set to False in the config) are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-01-18), has public PoCs available, and EPSS assigns a 99.2% probability of exploitation within 30 days, indicating an active exploitation threat.

What to do: Upgrade Apache Airflow to a version newer than 1.10.10 per vendor instructions; as an interim mitigation, set load_examples=False in the configuration so the vulnerable example DAGs are not loaded. Verify no example DAGs remain enabled in production, and review command and process history under the airflow worker/scheduler user for signs of exploitation, given the KEV listing and very high EPSS score.