# CVE-2020-13927: Apache Airflow's Experimental API Authentication Bypass

> CVE-2020-13927: Apache Airflow's Experimental API Authentication Bypass. CVSS 9.8 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2020-13927
Last updated: 2025-10-21T23:35:32Z

- Published: 2020-11-10 00:00 UTC · Updated: 2025-10-21 23:35 UTC · Assigner: apache
- CVSS: 9.8 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 99.8%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2022-01-18, federal due date 2022-07-18, ransomware use: Unknown

## Description

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html\#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default \`\[api\]auth\_backend = airflow.api.auth.backend.deny\_all\` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md\#experimental-api-will-deny-all-request-by-default

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- apache: airflow
- n/a: Apache Airflow

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2020-13927)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2020-13927)
- [http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html](http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html)
- [http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html](http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html)
- [https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E](https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%2540%3Cdev.airflow.apache.org%3E)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2020-13927 · Markdown: https://rewindex.com/cve/CVE-2020-13927.md · JSON: https://rewindex.com/api/v1/cves/CVE-2020-13927 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:16:27.337Z