---
id: "CVE-2020-13927"
kind: "vulnerability"
aliases: ["CVE-2020-13927"]
title: "Apache Airflow's Experimental API: Apache Airflow's Experimental API Authentication Bypass"
severity: "critical"
cvss: 9.8
epss: 0.99778
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache Airflow's Experimental API", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-airflow", "exploited", "package", "python", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "managed-hosting"]
published_at: "2020-11-10T16:15:11+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-13927", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13927", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13927", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apache Airflow's Experimental API: Apache Airflow's Experimental API Authentication Bypass

Apache Airflow's Experimental API previously allowed all requests without authentication by default. An unauthenticated attacker who can reach the API can trigger workflows and read or change Airflow state.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Airflow's Experimental API affected ? fixed ?

## Fix

Upgrade Apache Airflow to a release that includes the fix for CVE-2020-13927; CISA says apply vendor updates. Confirm the Experimental API auth settings in airflow.cfg.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-13927
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-13927
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-13927

## From the sources

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_