CVE-2020-11981: An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ)…

PriorityP277critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

33.74%

98.2th percentile

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	airflow	<= 1.10.10	—
apache_software_foundation	apache_airflow	—	—

Detection & IOCsextracted from sources · hover to see the quote

port6379

→Alert on outbound HTTP requests from Celery worker processes (e.g., curl) that were not initiated by a legitimate DAG task — a sign of successful command injection via the broker.
→Use Shodan/FOFA queries to identify exposed Apache Airflow and Redis instances that may be vulnerable: look for 'product:redis', 'http.title:airflow - dags', or 'http.title:sign in - airflow'.
→Monitor for unauthenticated TCP connections to Redis port 6379 from external/untrusted sources, especially those pushing base64-encoded Celery task messages to the 'default' queue.

·Exploitation requires the attacker to have direct network access to the Redis or RabbitMQ broker — the vulnerability is not exploitable if the broker is properly firewalled from untrusted networks. ↗
·This vulnerability only affects deployments using CeleryExecutor; other executor types (LocalExecutor, KubernetesExecutor) are not affected. ↗
·The nuclei template is marked 'intrusive' and sends a real exploit payload (LPUSH with a crafted Celery task) — do not run against production systems without authorization.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.