CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Apache Airflow's Experimental API Authentication Bypass
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
Affected products
apache: airflow
References7
- lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea… Mailing ListVendor Advisory
- lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea… Mailing ListVendor Advisory
- packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Rem… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Rem… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Rem… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Rem… ExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… Third Party AdvisoryUS Government Resource
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% percentile: 100 · as of 2 November 2026
- CWE
- CWE-306CWE-1188CWE-1056
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.