Command injection via Celery broker in Apache Airflow

CRITICAL 9.8CVE-2020-11981 · BIT-airflow-2020-11981 · GHSA-976r-qfjj-c24w · Published 17/07/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 1.10.11rc1`	`1.10.11rc1`
airflow apache	`≤ 1.10.10`	No fix yet

Description

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-11981 · ADVISORY
apache/airflow commit 1dda6fd · WEB
apache/airflow commit afa4b11 · WEB
GitHub Advisory GHSA-976r-qfjj-c24w · ADVISORY
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E · WEB
web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free