ACTIVELY EXPLOITED
CVE-2020-13927: Apache Airflow's Experimental API Authentication Bypass
| Vendor | Apache |
|---|---|
| Product | Airflow's Experimental API |
| Actively exploited | Yes |
| Added to CISA KEV | 18 Jan 2022 |
| CISA federal deadline | 18 Jul 2022 |
| Weakness (CWE) | CWE-1188, CWE-306 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
SOURCES
Other Apache flaws
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.