Live › vulnerability › CVE-2020-11978
Go to dashboardApache Airflow ships an example DAG with a command injection flaw, so a crafted request can make the server run attacker-supplied shell commands. It is on CISA's Known Exploited Vulnerabilities list and has an EPSS score of 0.992, meaning exploitation is very likely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Airflow | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
This page as .md · .json · in your agent: get_signal("CVE-2020-11978")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.