{"id":"CVE-2020-13927","kind":"vulnerability","aliases":["CVE-2020-13927"],"related":[],"title":"Apache Airflow's Experimental API: Apache Airflow's Experimental API Authentication Bypass","description":"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default","summary":"Apache Airflow's Experimental API previously allowed all requests without authentication by default. An unauthenticated attacker who can reach the API can trigger workflows and read or change Airflow state.","severity":"critical","cvss":9.8,"epss":0.99778,"exploited":true,"exploited_at":"2022-01-18T00:00:00+00:00","products":[{"name":"Apache Airflow's Experimental API","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-airflow","exploited","package","python","self-hosted"],"not_affected_if":["auth-required","default-config","managed-hosting"],"how_to_check":null,"fix":"Upgrade Apache Airflow to a release that includes the fix for CVE-2020-13927; CISA says apply vendor updates. Confirm the Experimental API auth settings in airflow.cfg.","status":"open","published_at":"2020-11-10T16:15:11+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:35+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:31:35Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Airflow to a release that includes the fix for CVE-2020-13927; CISA says apply vendor updates. Confirm the Experimental API auth settings in airflow.cfg.","reach":"network","impact":"high","summary":"Apache Airflow's Experimental API previously allowed all requests without authentication by default. An unauthenticated attacker who can reach the API can trigger workflows and read or change Airflow state.","category":"package","who_cares":["apache-airflow","self-hosted","python"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker triggers DAG runs and reads Airflow data","analyst_note":"Sources do not name fixed or affected versions or the exact config key; check the Apache Airflow security advisory for CVE-2020-13927 for those.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required","default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000466,"input_tokens":2817,"output_tokens":369,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Sources do not name fixed or affected versions or the exact config key; check the Apache Airflow security advisory for CVE-2020-13927 for those.","search":"'-13927':15A,18A '-2020':14A,17A '/apache/airflow/blob/1.10.11/updating.md#experimental-api-will-deny-all-request-by-default':143C '/docs/1.10.11/security.html#api-authentication.':111C '1.10.11':93C 'airflow':2A,7A,20A,26B,34B,61B,68C,92C 'airflow.apache.org':110C 'airflow.apache.org/docs/1.10.11/security.html#api-authentication.':109C 'airflow.api.auth.backend.deny':133C 'allow':39B,74C 'apach':1A,6A,25B,33B 'apache':19A 'apache-airflow':24B 'api':5A,10A,23A,37B,53B,71C,76C,130C 'attack':48B 'auth':131C 'authent':11A,43B,79C 'backend':132C 'bypass':12A 'chang':60B,98C,114C,125C 'config':127C 'cve':13A,16A 'default':45B,65C,95C,104C,129C 'deni':100C 'document':107C 'exist':121C 'experiment':4A,9A,36B,70C 'experimental':22A 'exploit':27B 'fact':90C 'fix':115C 'github.com':142C 'github.com/apache/airflow/blob/1.10.11/updating.md#experimental-api-will-deny-all-request-by-default':141C 'guid':140C 'host':32B 'instal':119C 'mention':136C 'miss':88C 'need':123C 'new':118C 'note':112C 'packag':28B 'pose':82C 'previous':38B,64C 'python':29B 'reach':51B 'read':58B 'request':41B,77C,102C 'risk':84C 's':21A 'secur':83C 'self':31B 'self-host':30B 'set':66C 'state':62B 'trigger':55B 'unauthent':47B 'updat':139C 'user':86C,122C 'without':42B,78C 'workflow':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-11-10T16:15:11+00:00","kev":{"dateAdded":"2022-01-18","dueDate":"2022-07-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-13927","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-13927","severity":null,"published_at":"2022-01-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:25+00:00","note":null},{"source":"epss","external_id":"CVE-2020-13927","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13927","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-13927","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13927","severity":null,"published_at":"2020-11-10T16:15:11+00:00","modified_at":"2026-06-17T02:53:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}