CVE-2020-17511: Apache Airflow

Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days.

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.

Affected products

• Apache Airflow: before 1.10.13 (fixed in 1.10.13)

Published 2020-12-14. Last modified 2026-06-17.