Apache Airflow Experimental API Authentication Bypass (CVE‑2020‑13927)

Apache Airflow Experimental API Authentication Bypass (CVE‑2020‑13927)

What It Is

The Apache Airflow “Experimental API” was shipped with a default configuration that allowed any HTTP request to interact with the API without requiring authentication. This design flaw enables an unauthenticated actor to read or modify workflow metadata, trigger DAG runs, and potentially access downstream systems.

Exploitability

The vulnerability is trivially exploitable when the default setting is left unchanged. No special privileges or proof‑of‑concept code are required—simply sending a request to the API endpoint yields full access. The CVSS score is rated High by NVD, and the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Affected Products

• Apache Airflow (any version that includes the Experimental API, typically 1.10.x series)
• Deployments that have the Experimental API enabled with default settings.

Why It Matters for Compliance & Audit Readiness

• Access Controls – Unauthenticated API access violates the principle of least privilege and undermines IAM controls required by frameworks such as NIST 800‑53 AC‑2 and ISO 27001 A.9.
• Continuous Monitoring – Lack of authentication removes a key audit log source, making it harder to produce defensible evidence of who performed workflow actions.
• Vendor‑Management Controls – Relying on default configurations without verification breaches due‑diligence expectations in third‑party risk assessments.

Addressing this gap strengthens the trust‑and‑control assurance posture and provides clear, auditable evidence that access to critical orchestration functions is restricted and monitored.

Recommended Actions

• Review all Airflow deployments and verify the authenticate flag for the Experimental API is set to True or, preferably, disable the Experimental API entirely.
• Upgrade to the latest Airflow release where the default configuration has been hardened.
• Implement network‑level segmentation or firewall rules that restrict API access to trusted IP ranges.
• Enable comprehensive logging of API calls and integrate them with SIEM or continuous monitoring solutions.
• Document the control change in your vendor‑management and access‑control registers to demonstrate due diligence during audits.

Source: CISA KEV – CVE‑2020‑13927