CVE-2020-11978: Apache Airflow Command Injection

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-01-18. EPSS: 99.2% chance of exploitation in the next 30 days.

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

Affected products

• Apache Airflow: before 1.10.11 (fixed in 1.10.11)

Published 2020-07-17. Last modified 2026-06-17.