CVE-2020-13927VulnerabilityPublished 01/18/2022Updated 10/24/2026

CVE-2020-13927: Apache Airflow's Experimental API Authentication Bypass

Affects Apache Airflow's Experimental APISource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/18/2022
KEV deadline: 07/18/2022
EPSS: 99.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-13927 (opens in a new tab)

Description

CVE-2020-13927 is a vulnerability in Apache Airflow's Experimental API where the default configuration allowed all API requests without requiring authentication. This authentication bypass flaw could enable unauthorized users to access the API. The issue has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

Apache Airflow's Experimental API previously had a default setting that permitted all API requests without authentication, leading to an authentication bypass vulnerability identified as CVE-2020-13927. This flaw allows unauthorized access to the API, potentially exposing sensitive operations or data. The vulnerability has been observed to be exploited in the wild. However, no explicit details on affected versions or remediation status are provided in the source data.

Impact

The vulnerability allows unauthorized users to bypass authentication controls on Airflow's Experimental API, potentially leading to unauthorized access to API endpoints. This could result in unauthorized information disclosure or manipulation of Airflow workflows depending on the API capabilities. The presence of known exploitation in the wild indicates active threat usage.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, users should disable the Experimental API or restrict access to trusted users and networks to mitigate unauthorized access risks.

CVE-2020-13927: Apache Airflow's Experimental API Authentication Bypass

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:56:55 UTC

Weaknesses

References

Related threats