CVE-2020-11978
published 2020-07-17CVE-2020-11978: An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs…
PriorityP192high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-07-18
Exploited in the wild
EPSS
99.12%
99.9th percentile
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 1.10.11 | 1.10.11 |
| apache_software_foundation | apache_airflow | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Unpause (CVE-2020-11978)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/experimental/dags/sample_trigger_target_dag/paused/false"; fast_pattern; reference:cve,2020-11978; classtype:attempted-admin; sid:2035036; rev:1; metadata:attack_target Server, created_at 2022_02_01, cve CVE_2020_11978, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_02_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Create DAG (CVE-2020-11978)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/experimental/dags/sample_trigger_target_dag/dag_runs"; fast_pattern; reference:cve,2020-11978; classtype:attempted-admin; sid:2035035; rev:1; metadata:attack_target Server, created_at 2022_02_01, cve CVE_2020_11978, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_02_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Monitor for GET requests to /api/experimental/dags/example_trigger_target_dag/paused/false — this is the unpause step of the exploit chain, enabling the vulnerable DAG before injection. ↗
- →Monitor for POST requests to /api/experimental/dags/example_trigger_target_dag/dag_runs containing a 'conf' JSON body with shell metacharacters (e.g., "; ... #) in the 'message' field — this is the command injection payload delivery step. ↗
- →Check for the presence of the 'example_trigger_target_dag' DAG with a 'bash_task' task using BashOperator; if 'dag_run' is NOT present in the task's 'env' field, the instance is unpatched and vulnerable. ↗
- →The Nuclei template matches response body containing '"operator":"BashOperator"' and Content-Type application/json on the task status endpoint as confirmation of a vulnerable host. ↗
- →Use Shodan/FOFA queries to identify exposed Airflow instances: title:"Airflow - DAGs", http.html:"Apache Airflow", or http.title:"sign in - airflow". ↗
- ·Instances with load_examples=False are NOT vulnerable; the example_trigger_target_dag DAG is never loaded and the injection vector does not exist. ↗
- ·The Experimental REST API must be accessible (unauthenticated or authenticated) for exploitation; setting [api] auth_backend = airflow.api.auth.backend.deny_all mitigates the unauthenticated attack path (CVE-2020-13927 component). ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Remote code execution (RCE) in Apache Airflow
osv·2020-07-27
CVE-2020-11978 [HIGH] Remote code execution (RCE) in Apache Airflow
Remote code execution (RCE) in Apache Airflow
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting `load_examples=False` in the config then you are not vulnerable.
GHSA
Remote code execution (RCE) in Apache Airflow
ghsa·2020-07-27
CVE-2020-11978 [HIGH] CWE-77 Remote code execution (RCE) in Apache Airflow
Remote code execution (RCE) in Apache Airflow
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting `load_examples=False` in the config then you are not vulnerable.
OSV
CVE-2020-11978: An issue was found in Apache Airflow versions 1
osv·2020-07-17
CVE-2020-11978 CVE-2020-11978: An issue was found in Apache Airflow versions 1
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
VulnCheck
Apache Airflow Command Injection
vulncheck·2020·CVSS 8.8
CVE-2020-11978 [HIGH] CWE-78 Apache Airflow Command Injection
Apache Airflow Command Injection
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Affected: Apache Airflow
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2020-11978; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-06&host_type=src&vulnerability=cve-2020-11978; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-19&host_type=src&vulnerability=cve-2020-11978; https://dashboard.shadowserver.org/statistics/honeypot/vulnerab
CISA
Apache Airflow Command Injection
cisa·2022-01-18·CVSS 8.8
CVE-2020-11978 [HIGH] CWE-78 Apache Airflow Command Injection
Vulnerability: Apache Airflow Command Injection
Affected: Apache Airflow
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-11978
Remediation Due Date: 2022-07-18
Suricata
ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Unpause (CVE-2020-11978)
suricata·2022-02-01·CVSS 8.8
CVE-2020-11978 [HIGH] ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Unpause (CVE-2020-11978)
ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Unpause (CVE-2020-11978)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Unpause (CVE-2020-11978)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/experimental/dags/sample_trigger_target_dag/paused/false"; fast_pattern; reference:cve,2020-11978; classtype:attempted-admin; sid:2035036; rev:1; metadata:attack_target Server, created_at 2022_02_01, cve CVE_2020_11978, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_02_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Fac
Suricata
ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Create DAG (CVE-2020-11978)
suricata·2022-02-01·CVSS 8.8
CVE-2020-11978 [HIGH] ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Create DAG (CVE-2020-11978)
ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Create DAG (CVE-2020-11978)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Apache Airflow DAG Example RCE Attempt - Create DAG (CVE-2020-11978)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/experimental/dags/sample_trigger_target_dag/dag_runs"; fast_pattern; reference:cve,2020-11978; classtype:attempted-admin; sid:2035035; rev:1; metadata:attack_target Server, created_at 2022_02_01, cve CVE_2020_11978, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_02_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_
Exploit-DB
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
exploitdb·2021-06-02·CVSS 8.8
CVE-2020-13927 [HIGH] Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
---
# Exploit Title: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
# Date: 2021-06-02
# Exploit Author: Pepe Berba
# Vendor Homepage: https://airflow.apache.org/
# Software Link: https://airflow.apache.org/docs/apache-airflow/stable/installation.html
# Version: <= 1.10.10
# Tested on: Docker apache/airflow:1.10 .10 (https://github.com/pberba/CVE-2020-11978/blob/main/docker-compose.yml)
# CVE : CVE-2020-11978
#
# This is a proof of concept for CVE-2020-11978, a RCE vulnerability in one of the example DAGs shipped with airflow
# This combines with CVE-2020-13927 where unauthenticated requests to Airflow's Experimental API were allowded by default.
# Together, potentially allows unauthenticated RCE to Airflow
#
# Re
Nuclei
Apache Airflow <=1.10.10 - Remote Code Execution
nuclei·CVSS 8.8
CVE-2020-11978 [HIGH] Apache Airflow <=1.10.10 - Remote Code Execution
Apache Airflow <=1.10.10 - Remote Code Execution
Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use).
Template:
id: CVE-2020-11978
info:
name: Apache Airflow <=1.10.10 - Remote Code Execution
author: pdteam
severity: high
description: Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use).
impact: |
Metasploit
Apache Airflow 1.10.10 - Example DAG Remote Code Execution
metasploit·CVSS 8.8
CVE-2020-11978 [HIGH] Apache Airflow 1.10.10 - Example DAG Remote Code Execution
Apache Airflow 1.10.10 - Example DAG Remote Code Execution
This module exploits an unauthenticated command injection vulnerability by combining two critical vulnerabilities in Apache Airflow 1.10.10. The first, CVE-2020-11978, is an authenticated command injection vulnerability found in one of Airflow's example DAGs, "example_trigger_target_dag", which allows any authenticated user to run arbitrary OS commands as the user running Airflow Worker/Scheduler. The second, CVE-2020-13927, is a default setting of Airflow 1.10.10 that allows unauthenticated access to Airflow's Experimental REST API to perform malicious actions such as creating the vulnerable DAG above. The two CVEs taken together allow vulnerable DAG creation and command injection, leading to unauthenticated remote code execution
arXiv
ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense
arxiv_fulltext·2026-03-02
ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense
## Abstract
Large language models (LLMs) are increasingly being deployed as software engineering agents that autonomously contribute to repositories. A major benefit these agents present is their ability to find and patch security vulnerabilities in the codebases they oversee. To estimate the capability of agents in this domain, we introduce ZeroDayBench, a benchmark where LLM agents find and patch 22 novel critical vulnerabilities in open-source codebases. We focus our efforts on three popular frontier agentic LLMs: GPT-5.2, Claude Sonnet 4.5, and Grok 4.1. We find that frontier LLMs are not yet capable of autonomously solving our tasks and observe some behavioral patterns that suggest how these models can be improved in the domain of proactive cyberdefense.
## Introduction
Large langu
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Unit42
Network Security Trends: May-July 2021
blogs_unit42·2021-09-17
Network Security Trends: May-July 2021
## Executive Summary
Unit 42 researchers continue to observe network security trends, tracking how cybercriminals take advantage of vulnerabilities in the real world. The following sections present our analysis of the most recently published vulnerabilities, including their severity and category distribution. Additionally, we provide insight into how the vulnerabilities are exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. We highlight vulnerabilities ranked medium severity and above that were newly published from May-July 2021 in order to raise awareness of their active exploits in the wild. We then draw conclusions about the most commonly exploited vulnerabilities we observed attackers using, as well as the severity, category and
Unit42
Network Security Trends: May-July 2021
blogs_unit42·2021-09-17
Network Security Trends: May-July 2021
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: May-July 2021
Yue Guan
Lei Xu
Published: September 17, 2021
Malware
Trend Reports
Vulnerabilities
Attack analysis
Exploit
Exploit in the wild
Network security trends
## Executive Summary
Unit 42 researchers continue to observe network security trends, tracking how cybercriminals take advantage of vulnerabilities in the real world. The following sections present our analysis of the most recently published vulnerabilities, including their severity and category distribution. Additionally, we provide insight into how the vulnerabilities are exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls . We highlight vulnerabilities ranked medium sever
http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttps://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3Ehttp://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttps://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3Ehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11978
2020-07-17
Published
2022-01-18
Added to CISA KEV
Exploited in the wild