HackerFeeds
All CVEs

CVE-2020-11978

HIGH8.8
CISA KEV

Published 2020-07-17 · Updated 2026-06-17 · Source security@apache.org

Summary

CVE-2020-11978 is a high-severity (CVSS 8.8) vulnerability in Apache Airflow. CISA added it to the Known Exploited Vulnerabilities catalog on January 18, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 18, 2022. CISA does not currently list it as used in ransomware campaigns. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

All 41 known-exploited Apache vulnerabilities →

Description

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-78CWE-78

CISA Known-Exploited Vulnerability

Product: Apache — Airflow

Name: Apache Airflow Command Injection

Date added: 2022-01-18 · Due: 2022-07-18

Required action: Apply updates per vendor instructions.

References

View on NVD