CVE-2017-15720: Apache Airflow

High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days.

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.

Affected products

• Apache Airflow: up to and including 1.8.2

Published 2019-01-23. Last modified 2026-06-17.