CVE-2020-11978: Apache Airflow example DAG command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw allows authenticated remote code execution, is listed in CISA KEV, and has an EPSS probability near 1.0 with public exploit code available.

What it is

Apache Airflow 1.10.10 and below ship an example DAG containing an OS command injection flaw. Any authenticated user can execute arbitrary commands as the user running the Airflow worker or scheduler. Deployments with load_examples=False are not affected.

Impact

An attacker with a valid Airflow account gains remote code execution with the privileges of the worker or scheduler process, allowing full compromise of the Airflow host and any credentials or data it can reach.

Attack surface

Reachable over the network through the Airflow web interface by an authenticated user; no user interaction beyond normal authenticated access is required. The vulnerable component is the example DAG included by default unless examples are disabled.

Exploitation

CVE-2020-11978 is listed in CISA KEV with a 2022-01-18 addition date, and public exploit code is referenced on Packet Storm. EPSS gives a 30-day exploitation probability of 0.99189 (99.9th percentile), indicating active and widespread exploitation.

What to do

• Upgrade Apache Airflow to a version above 1.10.10 per vendor instructions.
• Set load_examples=False in airflow.cfg to remove the vulnerable example DAGs if upgrading is not immediately possible.
• Restrict Airflow web UI access to trusted networks and remove or disable unused user accounts.
• Run Airflow workers and schedulers with least-privilege service accounts and isolate them from sensitive systems.
• Audit DAG definitions and remove any example or unused DAGs that execute shell commands.

Detection

• Monitor Airflow worker and scheduler process trees for unexpected child processes such as shells or command interpreters.
• Alert on DAG runs of example DAGs, particularly those invoking Bash or Python operators with unusual arguments.
• Review Airflow audit and web access logs for authenticated users triggering example DAGs outside normal schedules.
• Hunt for outbound network connections or file writes originating from Airflow worker/scheduler hosts that deviate from baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.