CVE-2020-11981

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Affected

Apache Software Foundation · Apache Airflow

CVSS v4.0 GitHub

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

36.79% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-78

Published

2020-07-16

Updated

2024-08-04

Proof-of-concept exploits (2)

• navyaks55/Vulnerability_Exploitation0★ · 2022-12-06
• Evillm/CVE-2020-11981-PoC0★ · 2026-02-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-11981.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/airflow/CVE-2020-11981

Security advisories

• https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9…
• advisories/GHSA-976r-qfjj-c24w

References

• CVE Record
• NVD entry

Related

• CVE-2020-11978
• CVE-2023-4634
• CVE-2024-45590
• CVE-2024-8856
• CVE-2025-27520
• CVE-2025-49113