Description
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | Apache Airflow – < 1.10.14 | 1.10.14 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Airflow <1.10.14 - Authentication Bypass http/cves/2020/CVE-2020-17526.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 1.10.14 | 1.10.14 | GHSA-7mx5-x372-xh87 |
Advisories 1
- WID-SEC-2022-0184 Fortinet FortiAnalyzer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
References
- https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
- [oss-security] 20201221 CVE-2020-17526: Apache Airflow Incorrect Session Validation in Airflow Webserver with default config mailing-list
- [announce] 20210623 Success at Apache: Security in Practice mailing-list