{"id":"CVE-2020-11978","aliases":["BIT-airflow-2020-11978","EUVD-2020-0032","GHSA-rvmq-4x66-q7j3","PYSEC-2020-14"],"status":"published","title":"Remote code execution (RCE) in Apache Airflow","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.99189,"percentile":0.99934,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2020-07-16T00:00:00Z","modified":"2026-10-24T10:30:19Z","kev":{"date_added":"2022-01-18","due_date":"2022-07-18","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-01-18"},{"source":"kev","since":"2022-01-18"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/apache_airflow_dag_rce","title":"Apache Airflow 1.10.10 - Example DAG Remote Code Execution","type":"exploit","platform":"Linux,Unix","date":"2020-07-14","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/apache_airflow_dag_rce"},{"source":"pocgithub","id":"pberba/CVE-2020-11978","title":"pberba/CVE-2020-11978","date":"2021-05-22","url":"https://github.com/pberba/CVE-2020-11978"},{"source":"exploitdb","id":"EDB-49927","title":"Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution","type":"webapps","platform":"multiple","date":"2021-06-02","url":"https://www.exploit-db.com/exploits/49927"},{"source":"nuclei","id":"CVE-2020-11978","title":"Apache Airflow \u003c=1.10.10 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11978.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"apache-airflow","fixed_in":["1.10.11rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"airflow","fixed_in":["1.10.11"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11rc1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"airflow","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.11"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11rc1"}]}],"versions":["1.10.0","1.10.1","1.10.10","1.10.10rc1","1.10.10rc2","1.10.10rc3","1.10.10rc4","1.10.10rc5","1.10.1b1","1.10.1rc2","1.10.2","1.10.2b2","1.10.2rc1","1.10.2rc2","1.10.2rc3","1.10.3","1.10.3b1","1.10.3b2","1.10.3rc1","1.10.3rc2","1.10.4","1.10.4b2","1.10.4rc1","1.10.4rc2","1.10.4rc3","1.10.4rc4","1.10.4rc5","1.10.5","1.10.5rc1","1.10.6","1.10.6rc1","1.10.6rc2","1.10.7","1.10.7rc1","1.10.7rc2","1.10.7rc3","1.10.8","1.10.8rc1","1.10.9","1.10.9rc1","1.8.1","1.8.2","1.8.2rc1","1.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.11rc1"}]}],"versions":["1.8.1","1.8.2rc1","1.8.2","1.9.0","1.10.0","1.10.1b1","1.10.1rc2","1.10.1","1.10.2b2","1.10.2rc1","1.10.2rc2","1.10.2rc3","1.10.2","1.10.3b1","1.10.3b2","1.10.3rc1","1.10.3rc2","1.10.3","1.10.4b2","1.10.4rc1","1.10.4rc2","1.10.4rc3","1.10.4rc4","1.10.4rc5","1.10.4","1.10.5rc1","1.10.5","1.10.6rc1","1.10.6rc2","1.10.6","1.10.7rc1","1.10.7rc2","1.10.7rc3","1.10.7","1.10.8rc1","1.10.8","1.10.9rc1","1.10.9","1.10.10rc1","1.10.10rc2","1.10.10rc3","1.10.10rc4","1.10.10rc5","1.10.10"]}],"products":[{"vendor":"apache","product":"airflow"},{"vendor":"apache software foundation","product":"apache airflow"}],"references":[{"url":"https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E","tags":["x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence","web"]},{"url":"http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11978","tags":["government-resource","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11978","tags":["web","advisory"]},{"url":"https://github.com/apache/airflow/commit/2fa51576e1283f5732e38fada686fd248d9c3a1e","tags":["web"]},{"url":"https://github.com/apache/airflow/commit/4d8599e8b0520ff4226fbad72f724afae50fdd08","tags":["web"]},{"url":"https://github.com/apache/airflow/pull/9143","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-14.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rvmq-4x66-q7j3","tags":["advisory"]},{"url":"https://github.com/apache/airflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-11978","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","status":"published","published":"2020-07-16T00:00:00Z","modified":"2025-10-21T23:35:39.214Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:57.67317Z"}],"euvd":[{"id":"EUVD-2020-0032","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","status":"published","published":"2020-07-16T00:00:00Z","modified":"2025-10-21T23:35:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-01-18","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-rvmq-4x66-q7j3","title":"Remote code execution (RCE) in Apache Airflow","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting `load_examples=False` in the config then you are not vulnerable.","status":"published","published":"2020-07-27T16:57:33Z","modified":"2025-10-22T17:54:46Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2020-11978","title":"Apache Airflow Command Injection","description":"A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.","cwes":["CWE-78"],"kev":{"date_added":"2022-01-18","due_date":"2022-07-18","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2020-11978","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","status":"published","published":"2020-07-17T00:15:10.337Z","modified":"2026-06-17T02:51:10.52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:10.086163Z"}],"osv":[{"id":"CVE-2020-11978","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","status":"published","published":"2020-07-17T00:15:10.337Z","modified":"2026-10-24T10:30:19.364161922Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"GHSA-rvmq-4x66-q7j3","title":"Remote code execution (RCE) in Apache Airflow","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting `load_examples=False` in the config then you are not vulnerable.","status":"published","published":"2020-07-27T16:57:33Z","modified":"2025-10-22T19:19:13.120942Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"BIT-airflow-2020-11978","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","status":"published","published":"2024-03-06T11:01:37.264Z","modified":"2026-09-08T08:45:07.701873863Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"PYSEC-2020-14","description":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","status":"published","published":"2020-07-17T00:15:00Z","modified":"2023-12-06T01:00:02.579339Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}