[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOx0mQZSUlq_pYMZX9dAZxOZlPqGRaa_6tQ7cw0JPk3E":3,"g5a-risk:CVE-2020-13927":145},{"success":4,"data":5,"meta":143},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":46,"epssPercentile":27,"epssTimeSeries":47,"severity":48,"affectedProducts":49,"affectedProductsCount":55,"references":56,"referencesCount":84,"weaknesses":85,"weaknessesCount":104,"isActivelyExploited":4,"cisaInfo":105,"otxData":27,"relatedBlogPosts":106,"seoMetadata":107,"configurations":132,"relatedVendorCves":141,"notableEvents":142},"CVE-2020-13927","What is CVE-2020-13927?","The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https:\u002F\u002Fairflow.apache.org\u002Fdocs\u002F1.10.11\u002Fsecurity.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https:\u002F\u002Fgithub.com\u002Fapache\u002Fairflow\u002Fblob\u002F1.10.11\u002FUPDATING.md#experimental-api-will-deny-all-request-by-default","The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who ...","2020-11-10T16:15:11.807","2025-10-23T14:51:33.45",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":34,"CVSSMetricV2":35,"CVSSMetricV40":27},[16,30],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.9,{"Source":31,"Type":32,"CVSSData":33,"ExploitabilityScore":28,"ImpactScore":29},"134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},[],[36],{"Source":17,"Type":18,"CVSSData":37,"BaseSeverity":25,"ExploitabilityScore":43,"ImpactScore":44,"ACInsufInfo":45,"ObtainAllPrivilege":45,"ObtainUserPrivilege":45,"ObtainOtherPrivilege":45,"UserInteractionRequired":45},{"Version":38,"VectorString":39,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":40,"IntegrityImpact":40,"AvailabilityImpact":40,"BaseScore":41,"BaseSeverity":42,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:P\u002FI:P\u002FA:P","PARTIAL",7.5,"",10,6.4,false,0.99778,[46,46,46,46,46,46,46],"Critical",[50],{"vendor":51,"product":52,"version":53,"criteria":54,"vulnerable":4},"apache","airflow","*","cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",1,[57,64,67,73,75,77,79],{"url":58,"source":59,"tags":60},"http:\u002F\u002Fpacketstormsecurity.com\u002Ffiles\u002F162908\u002FApache-Airflow-1.10.10-Remote-Code-Execution.html","Packetstormsecurity",[61,62,63],"Exploit","Third Party Advisory","VDB Entry",{"url":65,"source":59,"tags":66},"http:\u002F\u002Fpacketstormsecurity.com\u002Ffiles\u002F174764\u002FApache-Airflow-1.10.10-Remote-Code-Execution.html",[61,62,63],{"url":68,"source":69,"tags":70},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E","Apache",[71,72],"Mailing List","Vendor Advisory",{"url":58,"source":59,"tags":74},[61,62,63],{"url":65,"source":59,"tags":76},[61,62,63],{"url":68,"source":69,"tags":78},[71,72],{"url":80,"source":81,"tags":82},"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13927","CISA",[62,83],"US Government Resource",7,[86,93,99],{"id":87,"name":88,"description":89,"extendedDescription":42,"status":90,"abstraction":91,"structure":92},"CWE-306","Missing Authentication for Critical Function","The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","Draft","Base","Simple",{"id":94,"name":95,"description":96,"extendedDescription":97,"status":98,"abstraction":91,"structure":92},"CWE-1056","Invokable Control Element with Variadic Parameters","A named-callable or method control element has a signature that\n\t\t\t\t\tsupports a variable (variadic) number of parameters or arguments.","This issue can prevent the product from running reliably.  If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.\nWith variadic arguments, it can be difficult or inefficient for manual analysis to be certain of which function\u002Fmethod is being invoked.","Incomplete",{"id":100,"name":101,"description":102,"extendedDescription":103,"status":98,"abstraction":91,"structure":92},"CWE-1188","Initialization of a Resource with an Insecure Default","The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.","Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value.  However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.",3,{"shortDescription":42,"requiredAction":42,"vulnerabilityName":42,"dateAdded":27},[],{"title":108,"metaDescription":109,"keywords":110,"canonicalUrl":111,"structuredData":112},"What is CVE-2020-13927? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2020-13927, a critical severity cyber security vulnerability from 2020. High exploit probability (99.8%). The previous default ...","CVE-2020-13927, CVE-2020-13927 vulnerability, CVE-2020-13927 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, apache security, airflow vulnerability, high risk vulnerability, actively exploited, exploit available","\u002Fwhat-is\u002Fcve-2020-13927",{"@context":113,"@type":114,"headline":108,"description":109,"datePublished":10,"dateModified":11,"author":115,"publisher":119,"about":123,"mainEntityOfPage":127,"articleSection":130,"keywords":131},"https:\u002F\u002Fschema.org","TechArticle",{"@type":116,"name":117,"url":118},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":116,"name":117,"url":118,"logo":120},{"@type":121,"url":122},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":124,"name":6,"description":125,"additionalType":126},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":128,"@id":129},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2020-13927","Cybersecurity","CVE-2020-13927, CVE-2020-13927 vulnerability, CVE-2020-13927 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[133],{"Operator":27,"Negate":27,"Nodes":134},[135],{"Operator":136,"Negate":45,"CPEMatch":137},"OR",[138],{"Vulnerable":4,"Criteria":54,"MatchCriteriaID":139,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":140,"VersionEndIncluding":27},"B9D4EEE1-539A-43A3-ACA1-7307F50600F5","1.10.11",[],[],{"lastModified":11,"cacheTime":144,"version":38},1793231830772,{"score":146,"band":48,"action":147,"scoredAt":148},90,"Emergency patch","2026-10-28T06:49:41.684093+00:00"]