Pip Apache-airflow vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Pip Apache-airflow: 2 record(s), with affected versions and fixes.
CVE-2020-13927
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-306 Nov 10, 2020
Apache Airflow's Experimental API Authentication Bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
CVE-2020-11978
High · 8.8
KEV Urgent · 76 Public exploit CWE-78 Jul 16, 2020
Apache Airflow Command Injection
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.