{"id":"CVE-2020-11978","published":"2020-07-17T00:15:10Z","modified":"2026-06-17T02:51:10Z","title":"Apache Airflow Command Injection","vendor":"Apache","product":"Airflow","tier":"core","eol":null,"description":{"text":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw in an example DAG shipped with Apache Airflow (versions 1.10.10 and below) lets an attacker run arbitrary OS commands on the Airflow component. Exploitation requires network access and any authenticated user account, with no user interaction; installations with load_examples=False are not affected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:07Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99189,"percentile":0.99934,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-01-18","dueDate":"2022-07-18","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-11978","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-01-18","exploitedFirstSeen":"2022-01-18","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2020-11978","date":"2023-12-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-06&host_type=src&vulnerability=cve-2020-11978","date":"2023-12-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-19&host_type=src&vulnerability=cve-2020-11978","date":"2023-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-14&host_type=src&vulnerability=cve-2020-11978","date":"2024-01-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-17&host_type=src&vulnerability=cve-2020-11978","date":"2024-01-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2020-11978","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2020-11978","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2020-11978","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2020-11978","date":"2024-01-25"}],"evidenceTotal":663,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E","tags":["Mailing List","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11978","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploited via remote command injection in a web-exposed DAG","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A remote code/command injection vulnerability was discovered in one of the example DAGs","start":65,"end":152}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Authenticated user runs arbitrary OS commands","mappingType":"primary_impact","evidence":[{"from":"description","quote":"would allow any authenticated user to run arbitrary commands","start":180,"end":240}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<1.10.11rc1"],"patched":["1.10.11rc1"],"from":["GHSA-rvmq-4x66-q7j3","PYSEC-2020-14"],"provenance":"source"}],"advisories":[{"id":"GHSA-rvmq-4x66-q7j3","url":"https://github.com/advisories/GHSA-rvmq-4x66-q7j3","severity":"HIGH","ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<1.10.11rc1"],"patched":["1.10.11rc1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0032","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0032","exploited":true,"exploitedSince":"2022-01-18","provenance":"source"},"exploits":[{"id":49927,"url":"https://www.exploit-db.com/exploits/49927","title":"Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution","type":"webapps","platform":"multiple","date":"2021-06-02","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2021-06-02"},"pocGithub":{"count":1,"skipped":0,"earliest":"2021-05-22","earliestUrl":"https://github.com/pberba/CVE-2020-11978","repos":[{"name":"pberba/CVE-2020-11978","url":"https://github.com/pberba/CVE-2020-11978","stars":8,"created":"2021-05-22"}]},"metasploit":[{"name":"Apache Airflow 1.10.10 - Example DAG Remote Code Execution","module":"exploit/linux/http/apache_airflow_dag_rce","type":"exploit","disclosureDate":"2020-07-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_airflow_dag_rce.rb"}],"nuclei":[{"id":"CVE-2020-11978","name":"Apache Airflow <=1.10.10 - Remote Code Execution","severity":"high","path":"http/cves/2020/CVE-2020-11978.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11978.yaml"}],"first":{"date":"2020-07-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_airflow_dag_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html","http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-07-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-05-22, Exploit-DB 2021-06-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_airflow_dag_rce.rb","provenance":"source"},{"date":"2020-07-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11978","provenance":"source"},{"date":"2022-01-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-01-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0032","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":550},"priority":{"score":69.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1747 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}