The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The previous default setting for Airflow's Experimental API was to allow all API requests without
    authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the
    default has been changed to deny all requests by default and is documented at
    https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for
    new installs but existing users need to change their config to default `[api]auth_backend =
    airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide:
    https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-
    default (CVE-2020-13927)

The version of Apache Airflow is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker     can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the     celery worker running arbitrary commands. (CVE-2020-11981)

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack     can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload     directly to the broker which could lead to a deserialization attack (and thus remote code execution) on     the Worker. (CVE-2020-11982)

  - An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection     vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any     authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on     the executor in use). If you already have examples disabled by setting load_examples=False in the config     then you are not vulnerable. (CVE-2020-11978)

  - The previous default setting for Airflow's Experimental API was to allow all API requests without     authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the     default has been changed to deny all requests by default and is documented at     https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for     new installs but existing users need to change their config to default     [api]auth_backend = airflow.api.auth.backend.deny_all as mentioned in the Updating Guide:
    https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default     (CVE-2020-13927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
415788	SCA: security update for apache-airflow (GHSA-hhx9-p69v-cx2j)	Tenable Cloud Security	SCA Checks	Local	critical
415788	SCA: security update for apache-airflow (GHSA-hhx9-p69v-cx2j)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
162136	Apache Airflow < 1.10.11 Multiple Vulnerabilities	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2020-13927

critical

Tenable Plugins

critical

critical

critical