CVE-2020-13927

Apache Airflow versions before 1.10.11 shipped with an insecure default for its Experimental API, which accepted all incoming requests with no authentication (CWE-306). An attacker who can reach the API over the network exploits it simply by sending unauthenticated requests — no credentials, special conditions, or user interaction are required. Successful abuse grants full unauthenticated access to the Experimental API's endpoints, and the two public PoCs demonstrate that on Airflow 1.10.10 this unauthenticated access leads to remote code execution. Any Airflow deployment predating 1.10.11 is affected, and even instances upgraded to 1.10.11 or later can remain exposed if they retained the old permissive API configuration, since the new deny-all default only protects fresh installs. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-01-18, and EPSS assigns a 99.8% probability of exploitation within 30 days.

What to do: Upgrade to Apache Airflow 1.10.11 or later and, critically, set [api] auth_backend = airflow.api.auth.backend.deny_all (or another authenticating backend) in airflow.cfg on existing installs, since upgrading alone does not fix retained configurations. Restrict network access to the Airflow webserver/API and verify the Experimental API cannot be reached without credentials. Per CISA's KEV required action, apply updates per vendor instructions.