# CVE-2020-11978: Remote code execution (RCE) in Apache Airflow

Source: https://junglewise.ai/threats/cve-2020-11978-apache-airflow-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-07-17. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2020-11978 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2020-07-17

A remote command injection vulnerability exists in an example DAG shipped with Apache Airflow versions 1.10.10 and below. Authenticated users can execute arbitrary commands as the user running the Airflow worker or scheduler. The vulnerability is only present if example DAGs are enabled (load_examples=True).

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow), [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2020-11978 exploited in the wild?** Yes. CVE-2020-11978 is known to be exploited in the wild, first recorded on 18 January 2022. Treat it as urgent.

**How severe is CVE-2020-11978?** Critical severity, with a CVSS score of 3.1, published 17 July 2020.

**Which products and versions are affected?** apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.10.11rc1.

**Is there a fix for CVE-2020-11978?** Yes. apache-airflow (PyPI): upgrade to 1.10.11rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-11978 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-11978?** Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-airflow (PyPI): upgrade to 1.10.11rc1 or later

  ```sh
  pip install "apache-airflow>=1.10.11rc1"
  ```


## Affected products

- Apache Airflow <= 1.10.10

## Identifiers

- CVE-2020-11978
- GHSA-rvmq-4x66-q7j3
- PYSEC-2020-14

## Timeline

- 2020-07-16: disclosed: NVD Published Date
- 2022-01-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)