CVE-2020-17526: apache software foundation apache airflow
Vulnerability summary
CVE-2020-17526 is a high (CVSS 7.7) vulnerability in apache software foundation apache airflow. EPSS estimates a 23.86% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities.
Timeline
- 21-12-2020PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
CVSS metrics
4 scores · 2 sources · 3 versions- OSV · PypiEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
23.86%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+0.53 pp
From 23.34% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Apache1 product
- airflow< 1.10.14
Apache software foundation1 product
- apache airflow≥ Apache Airflow, < 1.10.14
PyPI1 product
- apache-airflow< 1.10.14
3 vendors · 3 products
References
15 links- www.openwall.com/lists/oss-security/2020/12/21/1Mailing ListX Refsource MLISTWEBThird Party Advisory
