CVE-2020-17526 in the critical feed json
Incorrect Session Validation in Apache Airflow
published 2020-12-21 5 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2020-17526 , EUVD-2020-0041 , GHSA-7mx5-x372-xh87 , PYSEC-2020-22
- cvss
- 7.7
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 23.9%
- EPSS 23.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
Patch / fix
- pypi apache-airflow 1.10.14
- bitnami airflow 1.10.14
- Apache Software Foundation Apache Airflow 1.10.14
Exploit prediction
23.86% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Apache Airflow <1.10.14 - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:P/I:N/A:N |
| OSV | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <1.10.14 |
1.10.14 |
| bitnami | airflow | <1.10.14 |
1.10.14 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/apache/airflow/commit/2f3b1c780472afd4c8a93633e6633feb7083792e
web
-
github.com
/apache/airflow/commit/6b065840323f9a4fc8e372b458d26e419e4fa99b
web
-
github.com
/apache/airflow/commit/97b2735d65e95c4633966667b6db3908540f3937
web
-
github.com
/apache/airflow/commit/9e01476a50b9be27c4b1e6c6e24d36f290629195
web
-
github.com
/apache/airflow/commit/a8900fa5f2b8963e9f57ba4ae5520a5d339aeaad
web
-
github.com
/apache/airflow/commit/dfa7b26ddaca80ee8fd9915ee9f6eac50fac77f6
web
-
github.com
/apache/airflow/commit/fe6d00a54f83468e296777d3b83b65a2ae7169ec
web
-
lists.apache.org
/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
web, mailing-list, vendor-advisory, advisory
-
openwall.com
/lists/oss-security/2020/12/21/1
mailing-list, web, third-party-advisory, advisory
-
lists.apache.org
/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3E
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2020-17526
advisory, web
-
github.com
/advisories/GHSA-7mx5-x372-xh87
advisory
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-22.yaml
web
-
lists.apache.org
/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352@%3Cannounce.apache.org%3E
web
Sources
- CVE List CVE-2020-17526
- GitHub Advisory GHSA-7mx5-x372-xh87
- NVD CVE-2020-17526
- OSV BIT-airflow-2020-17526
- OSV PYSEC-2020-22
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.