CVE-2020-11978

What is Apache Airflow?

Apache Airflow is a widely used open-source platform for authoring, scheduling, and monitoring data pipelines — "workflows as code" for data engineering teams, commonly deployed with access to databases, cloud storage, and other systems the pipelines need to orchestrate. Airflow ships with a set of "example DAGs" (workflow definitions) intended purely as reference material for new users, which some deployments leave enabled in production without realizing the examples themselves could carry risk.

Affected Versions

Overview

CVE-2020-11978 is a command injection vulnerability (CWE-78) in one of Airflow's bundled example DAGs. A low-privileged, authenticated user of an Airflow installation that has example DAGs enabled — the default configuration in affected versions — can trigger the vulnerable example DAG to inject and execute arbitrary operating system commands (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High).

Technical Details

The vulnerable example DAG passes user-influenced parameters into a shell command without adequate sanitization. Because example DAGs are shipped enabled by default and are reachable by any authenticated Airflow user with permission to trigger DAG runs — not necessarily a full administrator — the practical privilege bar for exploitation is lower than the CVE's product description might suggest.

Discovery

Reported through Apache's standard security disclosure process and fixed in Airflow 1.10.11.

Exploitation Context

CISA added this CVE to KEV in January 2022 based on confirmed exploitation. This vulnerability is a clear example of a recurring theme across this era's CVEs: default configurations and bundled example content, meant purely for reference or onboarding, becoming a real production attack surface when left enabled — the same pattern seen with default API keys, example modules, and reference implementations across many other products.

Remediation

1. Upgrade to Apache Airflow 1.10.11 or later immediately.
2. Disable example DAGs in your Airflow configuration (load_examples = False) regardless of version, as a general hardening practice — production Airflow instances have no legitimate need for the example/reference DAGs to be loaded.
3. Restrict which users can trigger DAG runs to the minimum necessary, since exploitation only requires DAG-trigger permission, not full administrative access.
4. Audit DAG run history for unexpected executions of example DAGs if your instance ran an affected version with examples enabled.