Apache Airflow 1.10.10 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Airflow 1.10.10 - Example DAG Remote Code Execution', 'Description' = %q This module exploits an unauthenticated command injection...

Apache Airflow < 1.10.11 Multiple Vulnerabilities

The version of Apache Airflow is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities, including the following: - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker Redis, RabbitMQ directly, it i...

Apache Airflow Authentication Bypass (CVE-2020-13927)

An authentication bypass vulnerability exists in Apache Airflow API. Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to the affected system...

Apache Airflow Command Injection (CVE-2020-11978; CVE-2020-13927)

A command injection vulnerability exists in Apache Airflow. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Exploit for OS Command Injection in Apache Airflow

CVE-2020-11978: Remote code execution in Apache Airflow's Exa...

CVE-2020-13927

creationtimestamp| type| source ---|---|--- 2020-11-10 18:27:36+00:00| seen| https://t.me/cibsecurity/16094 2021-06-03 00:39:25+00:00| seen| https://t.me/pwnwikizhchannel/579 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-09-18 22:16:38+00:00| seen|...

CVE-2020-13927

Apache Airflow CVE-2020-13927: An authentication bypass existed in the Experimental API where unauthenticated requests could be processed by default in older Airflow versions. The issue was mitigated by changing the default from allowing all API requests to denying them by default starting with A...

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...