CVE-2020-13927Apache Airflow's Experimental API Authentication Bypass

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default

9.8 CRITICALEPSS 99.77%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 02:53 UTC

OverviewCVSS details

9.8CRITICALCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Nov 10, 2020
Assigner: apache

Affected

Apache Airflow

Versions: Apache Airflow <1.10.11

Exploitation

Public exploit: Yes · 2 references
CISA KEV: Listed · Jan 18, 2022
KEV due date: Jul 18, 2022
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 7

99.77%chance of exploitation in 30 days

Higher than 99.95% of CVEs

CVSS 3.1 · NVD

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 2.0 · NVD

7.5High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack vector: Network
Attack complexity: Low
Authentication: None
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5	HIGH	2.0NVD	AV:N/AC:L/Au:N/C:P/I:P/A:P

CISA required action

⚡ Known exploited · remediation due Jul 18, 2022

Apply updates per vendor instructions.

Details

CVE ID: CVE-2020-13927
Status: Analyzed
Assigner (CNA): apache
Published: Nov 10, 2020
Last modified: 2026-06-17 02:53 UTC
Weaknesses: CWE-306
CWE-1188
CWE-1056

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:31 UTC.